sca-remediation

Automate dependency vulnerability remediation using Endor SCA findings and UIA evidence.

10|2|Updated May 4, 2026

Search Tags:#dependency analysis #Gemini CLI #SCA #vulnerability remediation #PR/MR creation

Ready to run

npx skills add https://github.com/endorlabs/endor-labs-agent-kit --skill sca-remediation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sca-remediation
Source: https://github.com/endorlabs/endor-labs-agent-kit/tree/main/gemini/sca-remediation
Command: npx skills add https://github.com/endorlabs/endor-labs-agent-kit --skill sca-remediation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps to automate the process of identifying and remediating dependency vulnerabilities in a repository using Endor SCA findings and UIA evidence.

Core Features & Use Cases

Automated SCA Finding Analysis: Automatically checks for vulnerabilities in the repository based on Endor SCA findings.
VersionUpgrade/UIA Evidence: Utilizes VersionUpgrade/UIA evidence to determine the best remediation path.
Risk Assessment: Provides deterministic risk decisions for upgrades with indeterminate CIA status or high-risk signals.
Validation and PR/MR Creation: Performs local validation and creates PR/MR with remediation details after approval.
Use Case: For a repository with critical SCA findings, this Skill can analyze the findings, recommend the best upgrade, and create a PR/MR with the necessary changes.

Quick Start

Use the @sca-remediation command to check for P0 SCA findings in the current repository.

Frequently Asked Questions about sca-remediation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate dependency vulnerability remediation using SCA findings?▼

Automate dependency vulnerability remediation by analyzing Endor SCA findings and UIA evidence to assess risk and create PR/MRs. This Skill resolves projects, triages vulnerabilities, and handles repository interactions to streamline the upgrade process.

How does UIA evidence determine the best version upgrade path for vulnerable dependencies?▼

UIA evidence determines the best version upgrade path by providing deterministic risk decisions for indeterminate CIA status or high-risk signals. It validates whether an upgrade is safe before initiating local validation and PR/MR creation.

Do I need Endor tenant access and Git credentials to remediate SCA findings?▼

Yes, you need Endor tenant access and Git credentials to remediate SCA findings. The Skill requires Endor API access for vulnerability data and local Git credentials to perform repository interactions and create PR/MRs.

Can I automatically create a PR for P0 SCA findings in my repository?▼

Yes, you can automatically create a PR for P0 SCA findings by running the remediation command. The Skill analyzes critical findings, recommends upgrades, performs local validation, and creates a PR/MR with remediation details after approval.

What is the best way to handle high-risk signals during software composition analysis?▼

Handle high-risk signals during software composition analysis by applying deterministic risk decisions based on VersionUpgrade evidence. This approach evaluates CIA status to ensure upgrades are validated before PR/MR creation.

Does this vulnerability remediation process require the Gemini CLI?▼

Yes, this vulnerability remediation process requires the Gemini CLI to execute the automated workflow. It integrates with Endor APIs to fetch SCA findings and utilizes local Git for repository interactions and validation.