Endor Labs ai-plugins — agentic threat model

Not certain from the listing — relies on the host Claude Code model (likely Claude 3.5 Sonnet) for reasoning, making it susceptible to prompt injection attacks that could trick the agent into ignoring real vulnerabilities or introducing malicious code under the guise of a dependency fix.

The agent processes local codebase files, dependency manifests, and Endor Labs scan results. Risks include data exfiltration of proprietary source code or dependency trees if the agent is manipulated by malicious inputs within the codebase.

Orchestrated via Claude Code and MCP tools to drive the endorctl CLI. Insecure tool integration could allow an attacker to hijack CLI arguments or exploit the agent's capability to write 'in-place' code fixes, leading to unauthorized code modification.

Not certain from the listing — the agent runs locally within the user's development environment or CI/CD pipeline where Claude Code is hosted. If the environment lacks strict sandboxing, a compromised agent could escalate privileges or access sensitive local environment variables and secrets.

Not certain from the listing — relies on Claude Code's built-in logging and Endor Labs platform reporting. There is a risk of blind spots if the agent silently fails to report a critical vulnerability or if its remediation actions are not explicitly audited before commit.

The agent manages sensitive API keys/credentials to provision and authenticate the endorctl CLI. Weaknesses in credential storage or lack of explicit human-in-the-loop approval policies for code commits present significant compliance and security risks.

Operates as a plugin within the Claude Code ecosystem. It interacts directly with the primary coding agent, creating a risk of cascading trust failures where a compromised primary agent misuses the Endor Labs plugin tools to bypass security scans.