endor-reachability-provenance

Compare dependency graphs and function callpaths to produce reachability verdicts.

4|Updated Oct 18, 2025

Search Tags:#vulnerability #provenance #cve #oss #reachability #callgraph #ghsa

Ready to run

npx skills add https://github.com/endorlabs/endorlabs-sdk --skill endor-reachability-provenance

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: endor-reachability-provenance
Source: https://github.com/endorlabs/endorlabs-sdk/tree/main/agent-knowledge/skills/endor-reachability-provenance
Command: npx skills add https://github.com/endorlabs/endorlabs-sdk --skill endor-reachability-provenance

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps investigate vulnerability findings when dependency reachability, function reachability, and structured vulnerability metadata do not agree. It is designed to explain why a finding may look reachable at the dependency level while still failing strict vulnerable-function attribution.

Core Features & Use Cases

Reachability triage: Compare customer-tenant call graphs with oss vulnerability provenance to determine whether a vulnerable function is actually reachable.
Alias and metadata reconciliation: Check CVE and GHSA records for consistent affected package ranges, callpath URIs, and source attribution.
Mismatch classification: Distinguish provenance fragmentation, signature normalization issues, true non-reachability, and likely reachability.
Use case: Analyze a finding that reports a reachable dependency but an unreachable function and produce a clear verdict with next-step guidance.

Quick Start

Ask the Skill to triage a specific finding UUID and compare its customer graph evidence against oss vulnerability callpath metadata.

Frequently Asked Questions about endor-reachability-provenance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Why does my vulnerability finding show a reachable dependency but an unreachable function?▼

Reachability mismatches occur when dependency graphs confirm a vulnerable package is reachable, but function-level callpaths fail to connect to the specific vulnerable code. This Skill compares customer namespace call graphs against oss vulnerability provenance to classify the discrepancy.

How do I triage a reachable dependency finding with an unreachable vulnerable function?▼

To triage the conflict, provide the specific finding UUID and compare its customer graph evidence against oss vulnerability callpath metadata. The analysis produces a strict reachability verdict distinguishing true non-reachability from provenance fragmentation or signature normalization issues.

How does oss vulnerability provenance validation work for CVE and GHSA records?▼

Provenance validation checks CVE and GHSA records for consistent affected package ranges, callpath URIs, and source attribution. It cross-references oss namespace records with normalized function signatures to ensure vulnerability metadata accurately reflects reachable codepaths.

Can I validate affected_callpath_uris against customer namespace dependency graphs?▼

Yes, you can validate affected_callpath_uris by performing a structured comparison of customer namespace graphs against oss namespace records. This verifies whether the documented callpath URIs genuinely connect to vulnerable functions within your specific codebase.

What causes mismatched vulnerability reachability results in oss dependency analysis?▼

Mismatches are typically caused by provenance fragmentation, signature normalization issues, or true non-reachability. The Skill compares your dependency graphs and function-level callpaths against oss vulnerability provenance to classify the exact cause and provide next-step guidance.