endor-check

Check a specified package for vulnerabilities and malware risks across ecosystems.

2|Updated Feb 4, 2026

Search Tags:#security #vulnerabilities #malware #package #dependency #check

Ready to run

npx skills add https://github.com/endorlabs/skills-ideas --skill endor-check-endorlabs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: endor-check
Source: https://github.com/endorlabs/skills-ideas/tree/main/skills/endor-check
Command: npx skills add https://github.com/endorlabs/skills-ideas --skill endor-check-endorlabs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps developers confirm the safety of a specific package by checking known vulnerabilities and malware risks for that dependency.

Core Features & Use Cases

Targeted security checks: Validate a single package's safety before adding it to a project.
Ecosystem-aware analysis: Detect risks across common ecosystems (npm, Python, Go, Ruby, etc.) for the specified dependency.
Use Case: Imagine you are evaluating "lodash" before adding it to your codebase to ensure it has no CVEs or malware indicators.

Quick Start

Ask your assistant to check a specific package, for example "endor check lodash" to see if it is safe.

Frequently Asked Questions about endor-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check a package for vulnerabilities before adding it to my project?▼

To check a package for vulnerabilities, specify the dependency name and version to evaluate its safety across compatible ecosystems. The tool identifies known CVEs and malware indicators, returning a risk report with recommended actions.

Can I scan a dependency for malware across different ecosystems like npm and Python?▼

Yes, you can scan a dependency for malware across common ecosystems including npm, Python, Go, and Ruby. The analysis evaluates the specified package version against known malware indicators and vulnerability databases.

What is the best way to validate a single package's safety against known CVEs?▼

The best way to validate a single package's safety is to run a targeted security check using the package name and version. This evaluates the dependency for known CVEs and malware risks, providing recommended actions before integration.

Does dependency vulnerability checking work without specifying a package version?▼

Dependency vulnerability checking evaluates risks using the ecosystem, dependency name, and version. While specifying a version allows for precise risk evaluation, the tool applies fallback mechanisms to check for vulnerabilities when version data is incomplete.

What actions should I take after identifying malware risks in a dependency?▼

After identifying malware risks in a dependency, you should review the recommended actions provided in the risk report. These actions guide whether to avoid the package, update to a secure version, or apply mitigations before adding it to your codebase.