skills.rest
endorlabs
endorlabsOFFICIAL
Explore all skills by this author →
Website𝕏@EndorLabsGitHub

endor-reachability-provenance

Compare dependency graphs and function callpaths to produce reachability verdicts.

4|Updated Oct 18, 2025
Search Tags:#vulnerability#provenance#cve#oss#reachability#callgraph#ghsa
One-click install
npx skills add https://github.com/endorlabs/endorlabs-sdk --skill endor-reachability-provenance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: endor-reachability-provenance
Source: https://github.com/endorlabs/endorlabs-sdk/tree/main/agent-knowledge/skills/endor-reachability-provenance
Command: npx skills add https://github.com/endorlabs/endorlabs-sdk --skill endor-reachability-provenance

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps investigate vulnerability findings when dependency reachability, function reachability, and structured vulnerability metadata do not agree. It is designed to explain why a finding may look reachable at the dependency level while still failing strict vulnerable-function attribution.

Core Features & Use Cases

  • Reachability triage: Compare customer-tenant call graphs with oss vulnerability provenance to determine whether a vulnerable function is actually reachable.
  • Alias and metadata reconciliation: Check CVE and GHSA records for consistent affected package ranges, callpath URIs, and source attribution.
  • Mismatch classification: Distinguish provenance fragmentation, signature normalization issues, true non-reachability, and likely reachability.
  • Use case: Analyze a finding that reports a reachable dependency but an unreachable function and produce a clear verdict with next-step guidance.

Quick Start

Ask the Skill to triage a specific finding UUID and compare its customer graph evidence against oss vulnerability callpath metadata.

Frequently Asked Questions about endor-reachability-provenance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why does my vulnerability finding show a reachable dependency but an unreachable function?▼

Reachability mismatches occur when dependency graphs confirm a vulnerable package is reachable, but function-level callpaths fail to connect to the specific vulnerable code. This Skill compares customer namespace call graphs against oss vulnerability provenance to classify the discrepancy.

How do I triage a reachable dependency finding with an unreachable vulnerable function?▼

To triage the conflict, provide the specific finding UUID and compare its customer graph evidence against oss vulnerability callpath metadata. The analysis produces a strict reachability verdict distinguishing true non-reachability from provenance fragmentation or signature normalization issues.

How does oss vulnerability provenance validation work for CVE and GHSA records?▼

Provenance validation checks CVE and GHSA records for consistent affected package ranges, callpath URIs, and source attribution. It cross-references oss namespace records with normalized function signatures to ensure vulnerability metadata accurately reflects reachable codepaths.

Can I validate affected_callpath_uris against customer namespace dependency graphs?▼

Yes, you can validate affected_callpath_uris by performing a structured comparison of customer namespace graphs against oss namespace records. This verifies whether the documented callpath URIs genuinely connect to vulnerable functions within your specific codebase.

What causes mismatched vulnerability reachability results in oss dependency analysis?▼

Mismatches are typically caused by provenance fragmentation, signature normalization issues, or true non-reachability. The Skill compares your dependency graphs and function-level callpaths against oss vulnerability provenance to classify the exact cause and provide next-step guidance.

Related Skills

Explore More Software Engineering Skills→
VulnetixVulnetix
9

vuln

Look up vulnerability identifiers and package vulnerabilities via Vulnetix CLI.

Official
Advanced
abereghiciabereghici

typo-checker

Detect and fix typos in codebases using typos-cli.

Community
Intermediate
blackwell-systemsblackwell-systems
102

lsp-understand

Generate a Code Map with symbol and file analysis via agent-lsp MCP.

Community
Advanced
ArabelaTsoArabelaTso
142

control-flow-abstraction-generator

Generate abstract Control Flow Graphs with loops, branches, and function calls.

Community
Advanced