Support Apache-2.0 as a declared skill license (currently forced to MIT-0)

Summary

Following #2964, which added standard MIT alongside MIT-0 and introduced root package.json / LICENSE / COPYING detection, the stored-license allowlist still excludes every other common OSI license. A skill that declares Apache-2.0 in all of its sources is still presented as MIT-0.

Request: extend the same detection/allowlist mechanism to Apache-2.0 — and ideally to the broader SPDX set.

Skill

• Slug: chinese-trademark-search-skill
• Version: 1.2.0
• Publisher: @willeleven
• Source repo: https://github.com/WillEleven/chinese-trademark-search-skill

Problem

Every source of truth in the published folder declares Apache-2.0:

• package.json: "license": "Apache-2.0"
• LICENSE: full Apache License 2.0 text (201 lines)
• NOTICE: the Apache §4(d) NOTICE file, including an explicit §6 trademark reservation
• SKILL.md frontmatter: license: Apache-2.0
• GitHub repo: detected by GitHub as Apache-2.0 ("spdx_id": "Apache-2.0" via the repos API)

The ClawHub listing nevertheless shows MIT-0 — "Free to use, modify, and redistribute. No attribution required."

Evidence

In [email protected]:

// dist/schema/license.js
export const PLATFORM_SKILL_LICENSE = "MIT-0";
export const PLATFORM_SKILL_LICENSE_NAME = "MIT No Attribution";
export const PLATFORM_SKILL_LICENSE_SUMMARY =
  "Free to use, modify, and redistribute. No attribution required.";

// dist/schema/schemas.d.ts
license?: "MIT-0" | null | undefined

clawhub skill publish --help exposes no --license flag, so a publisher has no way to declare anything else.

(Note on timing: [email protected] was published at 2026-08-04T04:01Z, ~22 minutes before #2964 was closed at 04:23Z, so this CLI copy predates the MIT work. If the server side already stores MIT, the CLI schema is at least out of date — but Apache-2.0 appears unsupported on either side.)

Why this matters

MIT-0, MIT and Apache-2.0 are materially different, and the gap is larger than the MIT-0 → MIT case already accepted in #1377:

For this skill the last two rows are the reason Apache-2.0 was chosen: the publisher operates in the IP-services space, and §6 is what keeps a fork from implying an official product. Displaying MIT-0 tells users that attribution is not required and that no patent or trademark terms apply — none of which the publisher granted.

Proposed resolution (in preference order)

1. Add Apache-2.0 to the stored-license allowlist, reusing the detection added in #2964 (root package.json → LICENSE text → SKILL.md frontmatter), including the existing backfill path for already-published versions.
2. Accept the broader SPDX identifier set, with a small curated allowlist if arbitrary values are undesirable.
3. At minimum, stop defaulting to a concrete license. When no supported license is detected, display Unspecified — see source repository rather than asserting MIT-0. Attributing a license the publisher never declared is a misstatement of terms, independent of which licenses are supported.

Happy to test against a pre-release CLI if that helps.

Discord 短版（如果先在 Discord 问）

Hi — following #2964 (MIT support added alongside MIT-0), is there any plan to support Apache-2.0 as a declared skill license? My skill declares Apache-2.0 in package.json, LICENSE, NOTICE and SKILL.md frontmatter, but the listing shows MIT-0 / "no attribution required". [email protected] has license?: "MIT-0" | null in its schema and publish has no --license flag, so there seems to be no way to declare it. The Apache §4(d) NOTICE and §6 trademark clauses are the reason I picked it, so MIT-0 misstates the terms. Happy to file an issue with details if that's the better channel.