Open Source License Check

Check if referenced bioinformatics software/code licenses allow commercial use (GPL vs MIT, etc.).

This skill is internally consistent and low-risk to run locally, but treat its outputs as informational only: the embedded LICENSE_DB and SKILL.md license table are simplified and contain inaccuracies (e.g., AGPL/GPL entries and the 'commercial use' flags are represented in a way that could be misleading). Before relying on results for business decisions: 1) review and update the LICENSE_DB against authoritative sources or OSI/SPDX references; 2) do not treat the tool as legal advice—consult counsel for licensing questions; 3) inspect/validate any requirements file you pass to the script (parsing is simplistic) and run the script in a sandboxed environment if you have concerns about file contents; and 4) consider adding explicit tests and version-pinned dependencies if you will deploy this in an automated pipeline.

Type: OpenClaw Skill Name: open-source-license-check Version: 1.0.0 The skill contains a potential local file inclusion (LFI) vulnerability in `scripts/main.py` because it opens and reads a user-provided file path via the `--check-requirements` argument without any path sanitization or validation. While `SKILL.md` includes a security checklist claiming that input file paths are validated and restricted to the workspace, the actual Python implementation lacks these controls. This discrepancy between the documentation's security claims and the actual code logic, combined with the lack of input sanitization, warrants a suspicious classification despite the absence of explicit malicious payloads.