skills.rest
endorlabs
endorlabsOFFICIAL
Explore all skills by this author →
Website𝕏@EndorLabsGitHub

sca-remediation

Automate dependency vulnerability remediation using Endor SCA findings and UIA evidence.

10|2|Updated May 4, 2026
Search Tags:#dependency analysis#Gemini CLI#SCA#vulnerability remediation#PR/MR creation
One-click install
npx skills add https://github.com/endorlabs/endor-labs-agent-kit --skill sca-remediation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sca-remediation
Source: https://github.com/endorlabs/endor-labs-agent-kit/tree/main/gemini/sca-remediation
Command: npx skills add https://github.com/endorlabs/endor-labs-agent-kit --skill sca-remediation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps to automate the process of identifying and remediating dependency vulnerabilities in a repository using Endor SCA findings and UIA evidence.

Core Features & Use Cases

  • Automated SCA Finding Analysis: Automatically checks for vulnerabilities in the repository based on Endor SCA findings.
  • VersionUpgrade/UIA Evidence: Utilizes VersionUpgrade/UIA evidence to determine the best remediation path.
  • Risk Assessment: Provides deterministic risk decisions for upgrades with indeterminate CIA status or high-risk signals.
  • Validation and PR/MR Creation: Performs local validation and creates PR/MR with remediation details after approval.
  • Use Case: For a repository with critical SCA findings, this Skill can analyze the findings, recommend the best upgrade, and create a PR/MR with the necessary changes.

Quick Start

Use the @sca-remediation command to check for P0 SCA findings in the current repository.

Frequently Asked Questions about sca-remediation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate dependency vulnerability remediation using SCA findings?▼

Automate dependency vulnerability remediation by analyzing Endor SCA findings and UIA evidence to assess risk and create PR/MRs. This Skill resolves projects, triages vulnerabilities, and handles repository interactions to streamline the upgrade process.

How does UIA evidence determine the best version upgrade path for vulnerable dependencies?▼

UIA evidence determines the best version upgrade path by providing deterministic risk decisions for indeterminate CIA status or high-risk signals. It validates whether an upgrade is safe before initiating local validation and PR/MR creation.

Do I need Endor tenant access and Git credentials to remediate SCA findings?▼

Yes, you need Endor tenant access and Git credentials to remediate SCA findings. The Skill requires Endor API access for vulnerability data and local Git credentials to perform repository interactions and create PR/MRs.

Can I automatically create a PR for P0 SCA findings in my repository?▼

Yes, you can automatically create a PR for P0 SCA findings by running the remediation command. The Skill analyzes critical findings, recommends upgrades, performs local validation, and creates a PR/MR with remediation details after approval.

What is the best way to handle high-risk signals during software composition analysis?▼

Handle high-risk signals during software composition analysis by applying deterministic risk decisions based on VersionUpgrade evidence. This approach evaluates CIA status to ensure upgrades are validated before PR/MR creation.

Does this vulnerability remediation process require the Gemini CLI?▼

Yes, this vulnerability remediation process requires the Gemini CLI to execute the automated workflow. It integrates with Endor APIs to fetch SCA findings and utilizes local Git for repository interactions and validation.

Related Skills

Explore More Software Engineering Skills→
endorlabsendorlabs
10

repository-dependency-reviewer

Review repository dependencies for risks using local manifests and Endor MCP tools.

Official
Advanced
williamzujkowskiwilliamzujkowski
17

threat-modeling

Apply STRIDE threat modeling and DREAD prioritization to identify security threats.

Community
Advanced
hiddink-aihiddink-ai
1

cve-triage

Automate CVE report triage with security analysis and remediation planning.

Official
Advanced
yanochka11yanochka11

dependency-audit

Audit Python, Node.js, Rust, and Go dependencies for vulnerabilities and conflicts.

Community
Intermediate