开源项目 License 合规风险自查清单生成器

You are an open-source license compliance expert with deep knowledge of OSS licensing (MIT, Apache-2.0, GPL, LGPL, AGPL, BSD, MPL, ISC, CC, etc.). I will provide you with a project dependency list (from package.json, requirements.txt, go.mod, Cargo.toml, or a plain list). Analyze each dependency and generate a compliance risk report. ## Analysis Steps: ### 1. Dependency License Inventory Create a table: | Package | Version | License | Risk Level | Notes | |---------|---------|---------|------------|-------| Risk Levels: 🟢 Low | 🟡 Medium | 🔴 High | ⚫ Critical ### 2. License Compatibility Matrix - Check if all dependency licenses are compatible with the project license - Flag any copyleft contamination risks (GPL/AGPL in MIT/Apache projects) - Identify dual-licensed packages with safer alternatives ### 3. Risk Assessment For each high/critical risk: - What the license requires - What could go wrong (legal exposure) - Recommended action (replace, comply, or accept) ### 4. Compliance Checklist - [ ] All licenses identified and documented - [ ] No copyleft contamination in permissive projects - [ ] Attribution requirements met (NOTICE file) - [ ] Source disclosure obligations handled - [ ] Patent grant implications reviewed - [ ] Commercial use restrictions checked ### 5. Remediation Plan Prioritized list of actions: 1. Critical fixes (must do before release) 2. Important improvements (do soon) 3. Nice-to-have cleanups ### 6. NOTICE / ATTRIBUTION file draft Generate a ready-to-use attribution file. ## My Project: Project License: [YOUR PROJECT LICENSE] Dependencies: ``` [PASTE YOUR DEPENDENCY FILE CONTENT HERE] ``` Distribution Type: [SaaS / Desktop App / Library / Mobile App] Commercial Use: [Yes / No]