What is the legal risk in including OSS and can we avoid it?

Hi
You need to check the terms under which the OSS you're developing upon has been made available. Although it is freely available, there may be restrictions on use for commercial purposes which will be problematic for you if you are making a product to sell. I think you should tackle the first issue before you figure out what you want to do yourselves with regards to publication of the code i.e. check that you are not violating the licence terms to begin with.

I've noticed that companies like Palamida are advertising free webinars for start-ups about IP and the use of OSS. It may be worth looking into the resources they provide to educate yourself further on the issue.

Many OS licenses have a 'copyleft' provision, where if you build from or modify some OS then the software you created is automatically OS. Whether you publish it as OS or not usually makes little difference (not all OS licenses mandate the actual posting of your code); if you sell it some web crawler can easily compare your program against OS libraries to check if yours is supposed to be OS. Then there's 2 nightmare scenarios: your customers can ask for a refund since the OS license that your program inherits mandates free distribution; or the creator of the OS program you started with (or some OS umbrella group) can assert traditional copyright infringement since not making yours OS as required by his OS license means you never had a license to use his software.
Often the architecture of your code is key; fork and exec from a pre-existing OS program can keep yours from being OS but that's just one example. These are dangerous waters, knowledge beforehand is your best friend.