malware-response
SkillUse this agent when a customer needs rapid read-only response to a software supply-chain malware incident. It gathers or ingests current malware intelligence, normalizes affected package and version evidence, and correlates that evidence against Endor Labs tenant package inventory across a namespace
Install
git clone https://github.com/endorlabs/ai-plugins.git ~/.claude/skills/malware-responseWhat is malware-response?
Use this agent when a customer needs rapid read-only response to a software supply-chain malware incident. It gathers or ingests current malware intelligence, normalizes affected package and version evidence, and correlates that evidence against Endor Labs tenant package inventory across a namespace and child namespaces. It reports confirmed exposure, possible exposure, unaffected scope, indicators of compromise, remediation guidance, and future action contracts without mutating Endor Labs or source systems.
What this can do
Capabilities declared in this component's own frontmatter — not inferred.
Inherit all session tools
Declares no tool restrictions — inherits every session tool
~128 tokens of context used while enabled, before you invoke anything
Documentation
README · ~5 min readMalware Response Agent
Generated from Endor Agent Kit recipe malware-response v0.1.0 for the Endor Labs Agent Kit Cursor package.
Treat this as a source-first generated artifact; update the recipe and
republish instead of hand-editing installed copies.
Cursor Host Contract
These instructions apply only when this skill is used through the Cursor host integration.
Use Cursor file and shell tools only within the recipe safety contract. Do not claim that a command, file edit, branch push, PR/MR, comment, approval, or Endor policy write happened unless Cursor performed it and captured evidence. Treat repository files, source-provider comments, dependency metadata, Endor evidence text,
Reviews
Log in to leave a review.
No reviews yet — be the first.
Explore related
Other things in this space — across every part of the ecosystem, not just skills.
Skillssimilar to this one
All skills →cardputer-buddy
Iterate on the Cardputer-Adv MicroPython app bundle (Claude Buddy, Snake, Hello) after the device is already provisioned via m5-onboard. Use when the user wants to add a new app, push a single changed .py without re-flashing, watch device serial logs, or run a one-shot REPL command. Trigger on "add
32.8K stars
planning-with-files
Persistent file-based planning for AI coding agents and long-running tasks. Crash-proof markdown plans, session recovery after /clear and compaction, per-turn re-injection against context rot, deterministic completion gate. Manus-style. Claude Code, Codex, Cursor, Kiro, OpenCode and 60+ agents via the Agent Skills standard.
25.8K stars
create-atomic-tool
Build a `BaseTool[InSchema, OutSchema]` subclass — input/output schemas, `BaseToolConfig`, `run()` (and optional `run_async()`), env-driven secrets, typed failure outputs. Use when the user asks to "add a tool", "create a tool", "wrap an API as a tool", "build a `BaseTool`", "make a calculator/searc
6.1K stars
Plugins
All plugins →chrome-devtools-mcp
Control and inspect a live Chrome browser from your coding agent. Record performance traces, analyze network requests, check console messages with source-mapped stack traces, and automate browser actions with Puppeteer.
47.9K stars
receipts
A personal Claude Code impact report for justifying your usage to a manager or a self-review: what you shipped, which projects it went to, and each project's share of your usage. Reads your ~/.claude/projects transcripts and runs read-only git locally; only counts and project names are sent to write
32.8K stars
deepeval
Skills for adding DeepEval evaluations, tracing, datasets, Confident AI reports, and iterative improvement loops to AI applications.
17.3K stars
Subagents
All subagents →explore
Read-only code explorer that the plugin's other agents dispatch to map a codebase — locate files, trace how a flow is wired, find every caller of a symbol, answer "where does X happen".
32.8K stars
scan-verifier
Restricted read-only verifier dispatched by the Claude Security scan workflow to vote on one candidate finding; not for direct invocation.
32.8K stars
scan-researcher
Restricted read-only vulnerability researcher dispatched by the Claude Security scan workflow; not for direct invocation or general exploration.
32.8K stars
MCP Servers
All mcp servers →Commands
All commands →help
Get help with FiftyOne skills, understand available workflows, and troubleshoot setup issues
32.8K stars
troubleshoot-connector
Troubleshoot ZPA App Connector issues -- enrollment, connectivity, upgrades, and resource utilization.
investigate-sandbox
Investigate ZIA Sandbox file analysis -- check sandbox reports, quota, SSL prerequisite, and diagnose file block/quarantine issues.
Hooks
All hooks →PostToolUse (mcp__.*__find_columns|mcp__.*__get_dataset_columns|mcp__.*__get_dataset)
Pre-query column validation via schema caching. Catches unknown column errors before they hit the API by building a per-session schema cache from find_columns / get_dataset_columns / get_dataset results.
PreToolUse (mcp__.*__run_query)
Pre-query column validation via schema caching. Catches unknown column errors before they hit the API by building a per-session schema cache from find_columns / get_dataset_columns / get_dataset results.