package-risk-summary

A package risk summary requires the ecosystem, package name, and version as inputs. The Skill uses Endor's MCP and Endorctl API for read-only lookups to return a JSON object containing risk posture, findings, strengths, and data gaps.

A package risk profile includes vulnerabilities, malware, typosquat signals, package scores, license notes, recommended next checks, and data gaps to provide an evidence-backed assessment for a specific package version.

You can check dependency vulnerability and license information by requesting a risk profile summary for the package version. The output identifies known risks, license types, and potential issues within the JSON object.

Yes, package assessment lookups require endorctl and endor_mcp dependencies. These components facilitate read-only API queries to retrieve the risk posture, findings, strengths, and evidence for the specified package version.

A limitation of dependency analysis via this Skill is the strict requirement for exact version specification, meaning you cannot assess a package without a version. Additionally, the output may explicitly contain data gaps where evidence or risk posture information is incomplete.