From Endor Labs Agent Kit
Use when setting up Endor Labs Agent Kit for Claude Code, checking readiness, verifying Endor auth, choosing namespaces, or diagnosing missing endorctl, gh, Endor MCP, or workflow prerequisites.
How this skill is triggered — by the user, by Claude, or both
Slash command
/endor-labs-agent-kit:endor-agent-kit-setupThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Generated for the Endor Labs Agent Kit Claude Code plugin.
Generated for the Endor Labs Agent Kit Claude Code plugin.
endor-labs-agent-kit@endorlabs is the preferred Claude Code plugin id for new installs.ai-plugins@endorlabs users can keep using the legacy compatibility package.Triage AI SAST findings -> Claude Code agent ai-sast-triageDecide whether a dependency is safe to use -> Claude Code agent dependency-decision-helperDiagnose Endor setup and scan issues -> Claude Code agent endor-troubleshooterMalware Response -> Claude Code agent malware-responseSummarize package-version risk -> Claude Code agent package-risk-summaryAssess GitHub onboarding gaps -> Claude Code agent probe-droidPlan remediation across findings -> Claude Code agent remediation-plannerReview repository dependency manifests -> Claude Code agent repository-dependency-reviewerFind safe SCA remediation paths -> Claude Code agent sca-remediationAnalyze upgrade impact -> Claude Code agent upgrade-impact-analysisExplain vulnerability risk and remediation -> Claude Code agent vulnerability-explainerFrom the public ai-plugins distribution repository:
/plugin marketplace add endorlabs/ai-plugins --sparse .claude-plugin plugins/claude
/plugin install endor-labs-agent-kit@endorlabs
From a local checkout of the Agent Kit repository root:
/plugin marketplace add ./
/plugin install endor-labs-agent-kit@endorlabs
For package-only local validation, add the generated Claude marketplace:
/plugin marketplace add ./plugins/claude
/plugin install endor-labs-agent-kit@endorlabs
Use this setup workflow when the user asks to install, check, update, or remove
Endor Labs Agent Kit plugin support files, or when an Endor Agent Kit workflow
is blocked by missing endorctl, GitHub CLI, authentication, namespace, or
local toolchain readiness.
Be proactive about checking the environment, but do not make persistent changes without explicit user approval. Report evidence for each check. Never print secret values.
Setup may:
endorctl, gh, git, and
workflow-relevant language tooling.ENDOR_NAMESPACE from the current process environment and report it as
namespace provenance when present.~/.endorctl/config.yaml for non-secret fields such as
ENDOR_API and ENDOR_NAMESPACE.ENDOR_API_CREDENTIALS_* authentication variables by
key name only.gh authentication and point to official installation guidance.Setup must not:
endorctl scan.endorctl host-check.~/.endorctl/config.yaml or secret values.ENDORCTL_CONFIG or
--config-path at tenant-specific, customer-specific, production, backup,
or other non-default Endor config directories.ENDOR_API_CREDENTIALS_KEY or ENDOR_API_CREDENTIALS_SECRET..zshrc, .bashrc, or PowerShell profile.gh, package managers, language runtimes, Docker, JDKs, or build
tooling.Start with a concise readiness report. Separate configured state from verified state.
Include these sections when relevant:
For Endor auth, report sanitized fields only:
Endor config: found
API endpoint: https://api.endorlabs.com
Namespace candidates:
- ENDOR_NAMESPACE: not set
- ~/.endorctl/config.yaml ENDOR_NAMESPACE: example-namespace
Selected namespace: example-namespace from ~/.endorctl/config.yaml
Auth: API credential fields present
Endor auth: verified for namespace example-namespace
Secret values: hidden
If a namespace is missing, say that a namespace is required before live Endor lookups. If a namespace is detected, let the user use it or override it for the current workflow.
If ENDOR_NAMESPACE from the current process environment and
~/.endorctl/config.yaml disagree, surface both values and stop before live
Endor lookups. Ask the user which namespace to use for this workflow. Do not
silently trust either value, and do not unset environment variables or edit
config files unless the user explicitly asks for that separate operational
cleanup.
When the user selects or supplies a namespace, later workflow agents must pass
it explicitly with -n <namespace> or --namespace <namespace> for scoped
Endor lookups rather than relying on bare endorctl namespace resolution.
If endorctl is missing, offer documented install options in this order:
Only install endorctl after explicit approval. If installing to ~/bin, tell
the user how to update PATH for the current shell. Do not edit shell profiles.
If API credential fields are present, do not run browser auth unless the user
explicitly asks to switch or re-authenticate. If API credential setup is needed,
tell the user to set ENDOR_API_CREDENTIALS_KEY and
ENDOR_API_CREDENTIALS_SECRET through their preferred secure environment
mechanism.
When browser or SSO authentication is requested, confirm the namespace first. Use non-interactive flags where supported. If multi-tenant selection appears, summarize the available tenant choices and ask the user before retrying.
Prefer documented Endor API or endorctl api lookups for workflows that support
them. Configure Endor MCP only when a selected MCP-capable workflow needs it or
the user explicitly asks for it.
The distribution may include ready-to-use Endor MCP config snippets such as
root .mcp.json or Gemini mcpServers metadata. Treat those files as setup
inputs, not permission to start or register MCP without approval.
When MCP setup is requested:
npx is available.endorctl is available.npx -y endorctl ai-tools mcp-server.endor-cli-tools is already registered, report it and ask before
changing anything.Do not claim Endor MCP tools are available to a workflow until the host exposes
them in the current session. If MCP tools are unavailable, continue with
CLI-first workflows when they support endorctl api; otherwise record the
missing MCP capability in data_gaps.
Check gh auth status when workflows need GitHub evidence, repository
inventory, pull requests, or comments. If gh is missing, provide current
official installation guidance instead of installing it automatically.
Do not manage GitHub token scopes or create personal access tokens in v1. Verify only the specific read or write capability needed for the selected workflow.
Detect and report workflow-relevant package managers, language runtimes, and build tools. Do not install them.
When tooling is missing, report the affected validation step and ask the user to install it through their team-standard toolchain.
Setup never performs remediation, creates branches, opens PRs/MRs, posts comments, writes Endor policies, or runs scans. Mutating workflows such as SCA Remediation and AI SAST Triage keep those actions behind their generated agent approval gates.
.claude/agents/ when marketplace installation is available.mcpServers, permissionMode, or hooks in agent frontmatter; report unavailable MCP-only signals in data_gaps.Guides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.
npx claudepluginhub endorlabs/endor-labs-agent-kit --plugin endor-labs-agent-kit