endor-scan
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto dynamically download and execute theendorctlpackage from the official npm registry. This is the official tool provided by the vendor for the skill's stated purpose.- [COMMAND_EXECUTION]: The skill provides instructions for running security scans via theendorctlCLI, specifically using thescancommand with flags for dependencies, SAST, and secrets. These operations are restricted to the local repository path.- [DATA_EXPOSURE]: The skill reads repository manifest files (such aspackage.json,go.mod,pom.xml) to identify project dependencies. This is a standard and necessary function for a vulnerability scanner.
Audit Metadata