菜单
Use when resolving package-version lineage by manifest path and source ref/sha, or distinguishing direct vs transitive introduction paths—especially when the same package appears at multiple versions or via multiple manifest files.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | endor-dependency-provenance |
| description | Use when resolving package-version lineage by manifest path and source ref/sha, or distinguishing direct vs transitive introduction paths—especially when the same package appears at multiple versions or via multiple manifest files. |
Use this playbook when a package appears in multiple versions and you need exact introduction paths.
azure-core)Do not collapse by package name alone.
Use this grouping key before any rollup:
(target_dependency_package_name, dependency_file_path, source_code_version.ref|sha)
This keeps separate introduction paths distinct across manifest files and refs.
spec.target_dependency_package_name) and
spec.dependency_file_paths.Return a matrix with one row per introduction path:
azure-core) instead of full coordinate.requirements.txt, pyproject.toml, and uv.lock.| Need | Skill |
|---|---|
| Finding rows, scan UUIDs, project resolution | endor-retrieve-scan-results |
| Vuln fixed vs present at ref/sha | endor-sca-findings |
| Scan pipeline failure (deps never resolved) | endor-troubleshooting-scans |
Use when probing, verifying, or refreshing Endor Labs SDK credentials before API workflows—env-key scan, Client whoami check, endorctl detection, and interactive browser token refresh into .env. Step zero for any tenant session. Not for SSO policy mapping or AuthenticationLog RCA.
Use when authoring, validating, or importing custom OpenGrep/Semgrep rule YAML into Endor Labs SemgrepRule resources—rule syntax, Endor metadata shape, local opengrep/semgrep checks, or namespace import. Not for finding triage (hand off to endor-retrieve-scan-results).
Use when resolving package-version lineage by manifest path and source ref/sha, or distinguishing direct vs transitive introduction paths—especially when the same package appears at multiple versions or via multiple manifest files.
Fetch project call graph artifacts, decode zstd payloads into searchable node and edge files, and run safe direct-edge or multi-hop path searches on the customer PackageVersion plane. Use for static symbol paths (e.g. app code to a dependency API)—not for Finding/CVE reachability triage (hand off to endor-reachability-provenance), scan finding lists (endor-retrieve-scan-results), or natural-language function summaries (VectorStoreQuery; separate flow).
Use when extending the SDK client surface after OpenAPI changes—model sync, registry overlay, payload builders, and integration tests—when a new API resource appears, facade behavior diverges from the generated contract, or list/get/create needs validation. Not for hand-implementing every resource from scratch.
Use when triaging OpenAPI / model-sync upstream drift—CI or pre-push verify-upstream-only failures, or published endorctl newer than committed provenance. Covers regenerating registry_contract, stubs, and reference docs; reviewing generated diffs; optional local endorctl upgrades. Not for runtime SDK API errors (endor-troubleshoot-sdk).