lockfile sbom and license inventory

Build a CycloneDX 1.6 SBOM and license-risk report from npm, Poetry, pip, Cargo and go.sum lockfiles — fully offline.

Build a CycloneDX 1.6 JSON SBOM and a license-risk inventory from npm package-lock / yarn / pnpm, Poetry / Pipfile.lock / requirements.txt, Cargo.lock and go.sum — offline, no registry calls. Flags strong copyleft (GPL/AGPL), weak copyleft, proprietary/SSPL/BUSL and unknown licenses, and writes Markdown, CSV and the SBOM. Use when someone asks "what's in our dependencies?", "generate an SBOM" or "any GPL in the lockfile?".

What it does

• Runs entirely offline in standard-library Python (no network, no credentials, writes only inside the working folder).
• Ships with examples, unit tests (run on Python 3.8 / 3.9 / 3.13) and a references/sources.md citing the official specs used.
• Exit codes: 0 = clean / aligned, 1 = findings, 2 = bad input — ready for CI and agent loops.

Who it's for

Security-minded developers, MSPs, small-business IT, compliance leads and IR analysts who want a repeatable offline check their agent can run.

Not legal advice / limits

See the skill's references/sources.md and Known Limitations below. Compliance-flavored output is a draft for counsel, not a certification.