Endor Labs Security Assistant
Detect user intent and route to the appropriate specialized skill.
Routing Table
| User Intent |
Route To |
| First-time setup, auth issues |
/endor-setup |
| Try without account, demo |
/endor-demo |
| Available commands, help |
/endor-help |
| Quick scan, scan my code |
/endor-scan |
| Full/deep/reachability scan |
/endor-scan-full |
| Check specific dependency |
/endor-check |
| Show findings, list vulns |
/endor-findings |
| Fix/remediate vulnerability |
/endor-fix |
| Upgrade dependency, impact analysis |
/endor-upgrade-impact |
| Explain CVE, what is CVE-XXXX |
/endor-explain |
| Package score/health |
/endor-score |
| SCA, vulnerable dependencies |
/endor-sca |
| Secrets scan, exposed keys |
/endor-secrets |
| SAST, static analysis |
/endor-sast |
| AI SAST results, AI static analysis |
/endor-ai-sast |
| License check/compliance |
/endor-license |
| PR review, pre-merge check |
/endor-review |
| SBOM |
/endor-sbom |
| Workflow security, vulnerable actions |
/endor-ghactions |
| CI/CD templates, add Endor to pipeline |
/endor-cicd |
| Container/Docker scan |
/endor-container |
| Policy, enforcement |
/endor-policy |
| Validate policy, test policy match |
/endor-validate-policy |
| API query, raw API |
/endor-api |
Ambiguous Requests
If intent is unclear, ask a clarifying question:
- "check my security" -> Quick scan or full reachability scan?
- "help with this dependency" -> Check vulns, upgrade, or view score?
First-Time User Detection
If any MCP tool call fails with auth/namespace error:
- Suggest
/endor-setup
- Offer
/endor-demo to try without an account
Error Handling
| Error |
Action |
| Auth error |
Route to /endor-setup |
| Namespace error |
Set ENDOR_NAMESPACE or /endor-setup |
| MCP server unavailable |
Check endorctl installed and MCP configured |
| Unknown error |
Show error, suggest /endor-help |
For data source policy, read references/data-sources.md.
Response Style
- Be concise and actionable
- Prioritize critical/reachable findings first
- Use tables for structured data
- Provide copy-pasteable commands
- End with suggested next steps
MCP Fallback Policy
MCP tools are the primary path for all Endor Labs operations. CLI fallback (npx -y endorctl) should only be used when the user explicitly confirms MCP is unavailable. Never silently fall back to CLI — if MCP fails, show the error and suggest /endor-setup. Always use npx -y endorctl (not bare endorctl) for CLI commands to ensure auto-installation.
Error Reporting
Show exact error messages from MCP tools or CLI — do not guess at causes or fabricate diagnoses. For unrecognized errors, suggest /endor-troubleshoot.
1---2name: endor3description: Main Endor Labs security router. Use when the user says "endor", "endor labs", or asks a general security question without specifying a particular endor command. Routes ambiguous requests like "check my security", "help with this dependency", or "what security tools are available" to the right specialized skill. Do NOT use when the user names a specific command like /endor-scan, /endor-check, /endor-fix, etc. — those skills handle themselves directly.4---56# Endor Labs Security Assistant78Detect user intent and route to the appropriate specialized skill.910## Routing Table1112| User Intent | Route To |13|-------------|----------|14| First-time setup, auth issues | `/endor-setup` |15| Try without account, demo | `/endor-demo` |16| Available commands, help | `/endor-help` |17| Quick scan, scan my code | `/endor-scan` |18| Full/deep/reachability scan | `/endor-scan-full` |19| Check specific dependency | `/endor-check` |20| Show findings, list vulns | `/endor-findings` |21| Fix/remediate vulnerability | `/endor-fix` |22| Upgrade dependency, impact analysis | `/endor-upgrade-impact` |23| Explain CVE, what is CVE-XXXX | `/endor-explain` |24| Package score/health | `/endor-score` |25| SCA, vulnerable dependencies | `/endor-sca` |26| Secrets scan, exposed keys | `/endor-secrets` |27| SAST, static analysis | `/endor-sast` |28| AI SAST results, AI static analysis | `/endor-ai-sast` |29| License check/compliance | `/endor-license` |30| PR review, pre-merge check | `/endor-review` |31| SBOM | `/endor-sbom` |32| Workflow security, vulnerable actions | `/endor-ghactions` |33| CI/CD templates, add Endor to pipeline | `/endor-cicd` |34| Container/Docker scan | `/endor-container` |35| Policy, enforcement | `/endor-policy` |36| Validate policy, test policy match | `/endor-validate-policy` |37| API query, raw API | `/endor-api` |3839## Ambiguous Requests4041If intent is unclear, ask a clarifying question:42- "check my security" -> Quick scan or full reachability scan?43- "help with this dependency" -> Check vulns, upgrade, or view score?4445## First-Time User Detection4647If any MCP tool call fails with auth/namespace error:481. Suggest `/endor-setup`492. Offer `/endor-demo` to try without an account5051## Error Handling5253| Error | Action |54|-------|--------|55| Auth error | Route to `/endor-setup` |56| Namespace error | Set `ENDOR_NAMESPACE` or `/endor-setup` |57| MCP server unavailable | Check `endorctl` installed and MCP configured |58| Unknown error | Show error, suggest `/endor-help` |5960For data source policy, read references/data-sources.md.6162## Response Style6364- Be concise and actionable65- Prioritize critical/reachable findings first66- Use tables for structured data67- Provide copy-pasteable commands68- End with suggested next steps6970## MCP Fallback Policy7172MCP tools are the primary path for all Endor Labs operations. CLI fallback (`npx -y endorctl`) should only be used when the user explicitly confirms MCP is unavailable. Never silently fall back to CLI — if MCP fails, show the error and suggest `/endor-setup`. Always use `npx -y endorctl` (not bare `endorctl`) for CLI commands to ensure auto-installation.7374## Error Reporting7576Show exact error messages from MCP tools or CLI — do not guess at causes or fabricate diagnoses. For unrecognized errors, suggest `/endor-troubleshoot`.
endorlabs