# Workflow Toolkit notices

The executable, installer, and bundled support scripts are project-owned MIT-licensed source.
The workflow skill content is CC BY 4.0 unless its frontmatter states otherwise.

The integrated Lean skill is an adaptation of Tech Leads Club's `tlc-spec-lean` at commit
`0ab82f644cd9caf94c65347a50ad934800b0cbc4`. Its source URL, content hash, and `CC-BY-4.0`
license are pinned in [`skills-lock.json`](skills-lock.json) and its attribution is retained in
[`.agents/skills/wtk-lean/NOTICE.md`](.agents/skills/wtk-lean/NOTICE.md).

Project-owned skill adaptations retain their per-file `CC-BY-4.0` frontmatter. External skill
sources and reviewed revisions remain listed in [`skills-lock.json`](skills-lock.json).

The five bundled security lifecycle skills are reviewed copies of
[`antoniofulg/security-lifecycle`](https://github.com/antoniofulg/security-lifecycle) at commit
`bd1ae10f1db3d38e12166b8c789f0ec9d33253e3`. Their individual notices and retained license texts
remain inside each skill directory.

The bundled `security-pentest` skill is original Apache-2.0 work from security-lifecycle
contributors. Its license and provenance notice are retained inside its skill directory.