with one click
endorlabs-sdk
endorlabs-sdk contains 47 collected skills from endorlabs, with repository-level occupation coverage and site-owned skill detail pages.
Skills in this repository
Use when probing, verifying, or refreshing Endor Labs SDK credentials before API workflows—env-key scan, Client whoami check, endorctl detection, and interactive browser token refresh into .env. Step zero for any tenant session. Not for SSO policy mapping or AuthenticationLog RCA.
Use when authoring, validating, or importing custom OpenGrep/Semgrep rule YAML into Endor Labs SemgrepRule resources—rule syntax, Endor metadata shape, local opengrep/semgrep checks, or namespace import. Not for finding triage (hand off to endor-retrieve-scan-results).
Use when resolving package-version lineage by manifest path and source ref/sha, or distinguishing direct vs transitive introduction paths—especially when the same package appears at multiple versions or via multiple manifest files.
Fetch project call graph artifacts, decode zstd payloads into searchable node and edge files, and run safe direct-edge or multi-hop path searches on the customer PackageVersion plane. Use for static symbol paths (e.g. app code to a dependency API)—not for Finding/CVE reachability triage (hand off to endor-reachability-provenance), scan finding lists (endor-retrieve-scan-results), or natural-language function summaries (VectorStoreQuery; separate flow).
Use when extending the SDK client surface after OpenAPI changes—model sync, registry overlay, payload builders, and integration tests—when a new API resource appears, facade behavior diverges from the generated contract, or list/get/create needs validation. Not for hand-implementing every resource from scratch.
Use when triaging OpenAPI / model-sync upstream drift—CI or pre-push verify-upstream-only failures, or published endorctl newer than committed provenance. Covers regenerating registry_contract, stubs, and reference docs; reviewing generated diffs; optional local endorctl upgrades. Not for runtime SDK API errors (endor-troubleshoot-sdk).
Live API namespace consumer→producer project graph from PackageVersion + DependencyMetadata coordinates; optional focus-producer-project-uuid for breaking-change blast radius. Namespace-scoped, not single-project SBOM — use endor-project-retrieval-bundle for one repo.
Use when building a deterministic single-project retrieval bundle via endor-agent-context: context_manifest.json, dependency explorer artifacts, optional session summaries, PV index + hydration, optional call-graph export. Not for namespace topology or breaking-change consumer discovery—hand off to endor-namespace-relationship-map.
Use when investigating reachability provenance mismatches in vulnerability findings—comparing dependency reachability, function reachability, and oss vulnerability metadata; contradictory finding tags/summary text; validating affected_callpath_uris attribution; or CVE/GHSA alias consistency.
Use when retrieving scan results, findings, or reports for a specific project via Project → latest ScanResult → Finding rows. Default namespace=project.namespace without traverse on findings; use traverse only to discover Project when namespace is unknown, or when the user explicitly requests tenant-wide reports.
Use when routing estate-scale data pulls between Query graph joins and facade list/count/shard patterns after bounded topology discovery—choosing how to fetch counts, aggregates, or validated joins across many projects. Not for single-project RCA; hand off when full row export is needed without a validated Query join.
Use when tracing vulnerability and dependency lineage across Findings, PackageVersions, and SBOM artifacts to verify resolved vs present state at branch/commit scope—customer "is this fixed" asks, orphaned related-resource errors, patched-vs-upstream coordinate confusion, or UI export vs API mismatches.
Use when planning, validating, or troubleshooting Endor Enterprise SSO integrations—customer SSO setup, namespace access behavior, or claims-to-authorization mapping.
Use when investigating tenant SSO/login issues with AuthenticationLog, AuthorizationPolicy, and optional AuditLog—correlating IdP claims with Endor policy mapping, "no authorized tenant" symptoms, or exporting structured flow-agnostic auth investigation JSON.
Debug Endor Labs SDK errors, API failures, and test issues. Use when validating SDK behavior against endorctl or contracts, 404 after traverse, list ServerError at wrong namespace, update_mask validation failures, namespace mismatches, or unexpected test skips.
Use when doing scan pipeline RCA: resolve a project (including app scan-history URLs), compare scan pairs (heuristic or user-supplied), search embedded spec.logs for errors, diff aggregate metrics, and probe PackageVersion resolution_errors. Not for individual Finding rows or policy validation—hand off to sibling skills when deeper analysis is needed.
Validate Endor Labs policies against project finding data via the PolicyValidation API or endorctl. Use when checking whether an exception policy matches a finding, debugging VulnID/template_values, comparing SDK POST policy/validate to endorctl validate policy, or triaging 403 authz on customer namespaces.
Use when the user asks for tenant or namespace-level Endor Labs audit reports, CSV exports, Cursor canvases, or executive-style workflow summaries that are backed by bundled report scripts rather than day-0 SDK troubleshooting skills. Routes to auth, project inventory, CI version, finding trend, and PRF report playbooks. Not for single-project scan RCA, finding retrieval, SDK debugging, or policy validation.
Use when reviewing AuthorizationPolicy wire shape and claim/namespace form for common misconfigurations (comma-separated namespace blobs, wrong IdP claim keys, double provider suffixes), Auth Policy setup, or "no authorized tenant" after successful IdP login. Not for credential refresh (endor-auth-setup), Enterprise SSO planning (endor-sso-integration-validation-troubleshooting), or AuthenticationLog RCA (endor-troubleshoot-authlog).
Use when auditing tenant APIKey resources for expired or soon-to-expire credentials—listing keys on a namespace path, classifying expiration, and writing a CSV report (default 30-day lookahead). Not for bearer ENDOR_TOKEN refresh, SSO policy mapping, or AuthenticationLog RCA.
Use when aggregating AuthenticationLog login activity by user identity over a lookback window (default 90 days) into a CSV (identity, user identifiers, last login, login count). Shares helpers with auth troubleshooting. Not for SSO policy mapping or per-user auth RCA.
Use when charting cumulative weekly new vs resolved Critical/High reachable vulnerability trends from FindingLog group-by-time queries (CREATE/DELETE via FindingLog.list_groups). Default window is the past 90 days with complete weeks only; one Cursor canvas per namespace root with optional child traverse. Not for open Finding snapshots, PRF/PV resolution reports, or scan pipeline RCA.
Use when auditing projects whose latest scan in a recent window ran via CLI endorctl (not agentless Cloud)—aggregating project counts by ScanResult.spec.environment.endorctl_version for CI adoption, stale CLI versions, or version-specific rollout status. Not for scan pipeline RCA or Cloud vs CLI registration classification alone.
Use when classifying Projects as CLI-scanned (local endorctl) vs Cloud-scanned (agentless SCM integrations) via spec.git.external_installation_id. Tenant-wide runs emit CSV with installation names from Installation rows. Not for listing findings or scan pipeline diffs (hand off to sibling skills).
Use when finding potential duplicate Projects across a tenant and child namespaces: identical meta.name across namespaces, or names differing only when --name-strip-tokens is passed (no default). Excludes SBOM projects (spec.sbom). Emits flat CSV and a grouped canvas. Not for findings, scan RCA, or single-project classification alone.
Use when generating a tenant-wide PRF (potentially reachable function) vulnerability and PackageVersion resolution error report for main-context NuGet, NPM, Maven, and PyPI findings tagged FINDING_TAGS_POTENTIALLY_REACHABLE_FUNCTION. Outputs analysis JSON, Cursor canvas, and optional HTML/PDF. Not for per-finding reachability proof or scan pipeline RCA.
Use when probing, verifying, or refreshing Endor Labs SDK credentials before API workflows—env-key scan, Client whoami check, endorctl detection, and interactive browser token refresh into .env. Step zero for any tenant session. Not for SSO policy mapping or AuthenticationLog RCA.
Use when authoring, validating, or importing custom OpenGrep/Semgrep rule YAML into Endor Labs SemgrepRule resources—rule syntax, Endor metadata shape, local opengrep/semgrep checks, or namespace import. Not for finding triage (hand off to endor-retrieve-scan-results).
Use when resolving package-version lineage by manifest path and source ref/sha, or distinguishing direct vs transitive introduction paths—especially when the same package appears at multiple versions or via multiple manifest files.
Fetch project call graph artifacts, decode zstd payloads into searchable node and edge files, and run safe direct-edge or multi-hop path searches on the customer PackageVersion plane. Use for static symbol paths (e.g. app code to a dependency API)—not for Finding/CVE reachability triage (hand off to endor-reachability-provenance), scan finding lists (endor-retrieve-scan-results), or natural-language function summaries (VectorStoreQuery; separate flow).
Use when extending the SDK client surface after OpenAPI changes—model sync, registry overlay, payload builders, and integration tests—when a new API resource appears, facade behavior diverges from the generated contract, or list/get/create needs validation. Not for hand-implementing every resource from scratch.
Use when triaging OpenAPI / model-sync upstream drift—CI or pre-push verify-upstream-only failures, or published endorctl newer than committed provenance. Covers regenerating registry_contract, stubs, and reference docs; reviewing generated diffs; optional local endorctl upgrades. Not for runtime SDK API errors (endor-troubleshoot-sdk).
Live API namespace consumer→producer project graph from PackageVersion + DependencyMetadata coordinates; optional focus-producer-project-uuid for breaking-change blast radius. Namespace-scoped, not single-project SBOM — use endor-project-retrieval-bundle for one repo.
Use when building a deterministic single-project retrieval bundle via endor-agent-context: context_manifest.json, dependency explorer artifacts, optional session summaries, PV index + hydration, optional call-graph export. Not for namespace topology or breaking-change consumer discovery—hand off to endor-namespace-relationship-map.
Use when investigating reachability provenance mismatches in vulnerability findings—comparing dependency reachability, function reachability, and oss vulnerability metadata; contradictory finding tags/summary text; validating affected_callpath_uris attribution; or CVE/GHSA alias consistency.
Use when retrieving scan results, findings, or reports for a specific project via Project → latest ScanResult → Finding rows. Default namespace=project.namespace without traverse on findings; use traverse only to discover Project when namespace is unknown, or when the user explicitly requests tenant-wide reports.
Use when routing estate-scale data pulls between Query graph joins and facade list/count/shard patterns after bounded topology discovery—choosing how to fetch counts, aggregates, or validated joins across many projects. Not for single-project RCA; hand off when full row export is needed without a validated Query join.
Use when tracing vulnerability and dependency lineage across Findings, PackageVersions, and SBOM artifacts to verify resolved vs present state at branch/commit scope—customer "is this fixed" asks, orphaned related-resource errors, patched-vs-upstream coordinate confusion, or UI export vs API mismatches.
Use when planning, validating, or troubleshooting Endor Enterprise SSO integrations—customer SSO setup, namespace access behavior, or claims-to-authorization mapping.
Use when investigating tenant SSO/login issues with AuthenticationLog, AuthorizationPolicy, and optional AuditLog—correlating IdP claims with Endor policy mapping, "no authorized tenant" symptoms, or exporting structured flow-agnostic auth investigation JSON.