skills.rest
endorlabs
endorlabsOFFICIAL
Explore all skills by this author →
Website𝕏@EndorLabsGitHub

endor-scan

Scan code repositories for vulnerabilities, secrets, and SAST issues.

2|Updated Feb 4, 2026
Search Tags:#security#mcp#secrets#sast#vulnerabilities#code-scan#incremental-pr
One-click install
npx skills add https://github.com/endorlabs/skills-ideas --skill endor-scan-endorlabs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: endor-scan
Source: https://github.com/endorlabs/skills-ideas/tree/main/skills/endor-scan
Command: npx skills add https://github.com/endorlabs/skills-ideas --skill endor-scan-endorlabs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Fast security scanning of the current repository to surface vulnerabilities, secrets, and SAST issues.

Core Features & Use Cases

  • Incremental PR scans for changes, full repository quick scans by default, and language detection from manifests; supports deterministic MCP-based scanning with a CLI fallback when MCP is unavailable.

Quick Start

Run a fast security scan on the current repository using the Endor MCP tool with default scan types and quick_scan enabled.

Frequently Asked Questions about endor-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a fast security scan on my code repository?▼

Run a fast security scan on your code repository by using the Endor MCP tool with quick_scan enabled to surface default scan types including vulnerabilities, dependencies, SAST, and secrets.

Can I scan only the changed code in a pull request for vulnerabilities?▼

Yes, you can scan only the changed code in a pull request by enabling incremental PR scans, which target vulnerabilities, secrets, and SAST issues specifically within the new changes.

What is the difference between a full repository quick scan and an incremental PR scan?▼

A full repository quick scan evaluates the entire codebase for vulnerabilities and secrets, whereas an incremental PR scan focuses only on the modified files in a pull request for faster feedback.

Does the security scanner work if the MCP server is unavailable?▼

Yes, the security scanner works if the MCP server is unavailable by automatically falling back to a CLI-based scanning approach to ensure vulnerabilities and SAST issues are still detected.

What types of security issues can I detect with a codebase SAST scan?▼

A codebase SAST scan detects vulnerabilities, dependency issues, hardcoded secrets, and static application security testing problems by analyzing manifests and source code.

Do I need to manually specify the programming language for a repository security scan?▼

No, you do not need to manually specify the programming language because the scanner automatically detects languages from project manifests during the quick scan process.

Related Skills

Explore More Software Engineering Skills→
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-scan

Scan code repositories for vulnerabilities, license issues, and secrets.

Official
Advanced
nikhillinitnikhillinit

security-scanner

Detect security vulnerabilities, secrets, and misconfigurations in codebases.

Community
Advanced
SensLiaoSensLiao

qa-static-baseline

Automate static code analysis and security scanning on pull requests or CI pipelines.

Community
Intermediate
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced