# Endor Scan Full

> Comprehensive security scan with full reachability analysis. Builds call graphs to determine which vulnerabilities are actually exploitable in your code. Use when the user says "full scan", "deep scan", "reachability scan", "which vulns are actually reachable", "endor scan full", or before a release. Takes 2-5 minutes. Do NOT use for quick daily scans (/endor-scan) or checking individual packages (/endor-check).

- Skill: `endorlabs/endor-scan-full` (Agent Skill)
- Install (CLI): `npx skillmds@latest add endorlabs/endor-scan-full`
- Raw SKILL.md: https://api.skillmd.com/api/skills/endorlabs/endor-scan-full/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: endorlabs (https://skillmd.com/u/endorlabs)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/endorlabs/endor-scan-full

---


# Endor Labs Full Reachability Scan

Comprehensive security scan with full call graph analysis to identify exploitable vulnerabilities.

## Quick Scan vs Full Scan

| Feature | Quick Scan | Full Scan |
|---------|-----------|-----------|
| Speed | Seconds | Minutes |
| Reachability | No | Full call graph |
| Call Paths | No | Yes |
| Prioritization | Severity only | Severity + reachability |
| Use Case | Daily dev | Pre-release, security reviews |

## CRITICAL: Scan Once, Cache Always

**Cache file:** `.endor/scan-full-results.json` (relative to repo root)

Rules:
1. **Before scanning**, check if cache exists. If yes, use cached results. Do not re-scan unless user explicitly requests it ("scan again", "re-scan", "run a new scan").
2. **After successful scan**, save complete raw results to cache immediately. Create `.endor/` if needed.
3. **On scan failure**, do not write cache. Report error.
4. **For follow-up questions** about findings, read cache instead of re-scanning. If a finding UUID is missing from `finding_details`, fetch via `get_resource` and update cache.
5. **Add `.endor/` to `.gitignore`** if not already present.

### Cache Format

```json
{
  "scan_timestamp": "ISO-8601",
  "scan_path": "/absolute/path",
  "scan_types": ["vulnerabilities", "dependencies", "secrets", "sast"],
  "scan_options": { "quick_scan": false },
  "raw_results": { ... },
  "finding_details": { "uuid-1": { ... }, "uuid-2": { ... } }
}
```

## Workflow

### Step 1: Check Cache

- **Cache exists**: Show timestamp, ask user to use cached or fresh scan. If cached, skip to Step 5.
- **No cache**: Proceed with scan.

### Step 2: Detect Repository Context

Detect languages and manifest files (same as `/endor-scan`).

### Step 3: Warn About Duration

> Full reachability analysis builds a call graph of your entire codebase. This typically takes 2-5 minutes depending on project size.

### Step 4: Run Full Scan

Use `scan` MCP tool:
- `path`: **absolute path** to repository root
- `scan_types`: `["vulnerabilities", "dependencies", "secrets", "sast"]`
- `scan_options`: `{ "quick_scan": false }`

**CLI fallback** (only if MCP genuinely unavailable):
```bash
npx -y endorctl scan --path <ABSOLUTE_PATH> --dependencies --sast --secrets --output-type json 2>/dev/null > /tmp/endor-full.json
```

On error, report exact error. Do not write cache on failure.

After successful scan: save to cache, add `.endor/` to `.gitignore`, then fetch details for each finding UUID via `get_resource` (`resource_type`: `Finding`) and append to `finding_details` in cache.

### Step 5: Interpret Reachability and Present Results

For reachability tag interpretation, read references/reachability-tags.md.

#### Priority Classification

| Priority | Dependency Tag | Function Tag | Action |
|----------|---------------|--------------|--------|
| **P0 - Fix Now** | REACHABLE_DEPENDENCY | REACHABLE_FUNCTION | Actively exploitable |
| **P1 - Investigate** | REACHABLE_DEPENDENCY | POTENTIALLY_REACHABLE_FUNCTION | Likely exploitable, verify |
| **P2 - Plan Fix** | REACHABLE_DEPENDENCY | UNREACHABLE_FUNCTION | Dep used, vuln func not called |
| **P3 - Track** | UNREACHABLE_DEPENDENCY | UNREACHABLE_FUNCTION | Not used, lowest risk |
| **P4 - Ignore** | (PHANTOM) | Any | Not installed |

When dep tag present but no function tag, classify on dep tag alone (function reachability unknown).

Present: scanned path, languages, "Full Reachability Analysis", timestamp, reachability summary table with counts per category, key insight ("X of Y vulns have confirmed reachable call path"), then P0-P3 finding tables (Package, Advisory, Severity, Description).

### Next Steps

1. `/endor-fix {top-advisory}` - fix reachable critical
2. `/endor-explain {advisory}` - explain a finding
3. `/endor-findings reachable` - view all findings
4. `/endor-upgrade-impact {package}` - upgrade with impact analysis

For data source policy, read references/data-sources.md.

## Error Handling

Show exact error messages — do not guess at causes.

| Error | Action |
|-------|--------|
| Auth error | Complete browser login, retry. If persistent, `/endor-setup` |
| Build fails | Fix build errors first, or use `/endor-scan` (no build required) |
| Timeout | Scan specific subdirectory |
| MCP unavailable | `/endor-setup`. CLI fallback only if user confirms |
| Unknown error | Show exact error, suggest `/endor-troubleshoot` |