Sysdig Skills

Sysdig Skills package Sysdig cloud security workflows as reusable agent skills that run inside AI coding agents such as Claude Code.

Sysdig Skills is generally available. Contact your Sysdig representative for more information.

Sysdig Skills package Sysdig cloud security workflows as reusable agent skills that run inside AI coding agents such as Claude Code. You can onboard environments, investigate vulnerabilities and runtime threats, remediate risks, and manage posture workflows without leaving your AI environment.

Install in Claude Code

  • /plugin marketplace add sysdig/skills
  • /plugin install headless-cloud-security@sysdig-skills

Skills

sysdig-onboarding

Connects your cloud accounts, clusters, and hosts to Sysdig Secure.

The skill can:

  • Connect AWS, GCP, and Azure cloud accounts
  • Connect Kubernetes clusters, including Windows nodes, and Linux hosts
  • Set up serverless workload scanning for AWS ECS and Fargate, AWS Lambda, and GCP Cloud Run
  • Generate Terraform configurations for cloud accounts and Helm values for Kubernetes
  • Validate prerequisites, deploy configurations, and verify connectivity
  • Run as a guided interview or as an autonomous, all-at-once workflow

sysdig-account-setup

Applies a baseline configuration to a Sysdig Secure tenant after it is connected. The skill works through the Sysdig MCP Server.

The skill can:

  • Establish an access baseline of teams, users, and roles
  • Establish a vulnerability management policy baseline for the pipeline and runtime stages, either as a single policy or split across stages
  • Assign compliance posture policies, such as CIS, PCI, and NIST, to zones
  • Enable or disable the recommended managed runtime threat detection policies
  • Review the current configuration, propose a structure, and apply changes repeatably, confirming with you before any change that modifies the tenant

Use this skill immediately after onboarding to leave an account usable out of the box. Fine-grained policy tuning is out of scope.

sysdig-sysql

Writes, debugs, and explains SysQL graph queries against the Sysdig security datastore.

The skill can:

  • Write and debug SysQL queries, and explain what an existing query does
  • Query inventory, vulnerability, posture, identity, and runtime data
  • Explore the SysQL schema, including entities, fields, and relationships
  • Validate the entities and fields in a query against the live schema before running it
  • Present results together with suggested follow-up queries

sysdig-investigate

Identifies and prioritizes vulnerable container images in Sysdig-monitored environments.

The skill can:

  • Work through a Plan configured by an administrator, or explore ranked jobs under a scope and measure you choose
  • Walk the prioritized remediation jobs one at a time
  • Filter, regroup, sort, and page through vulnerability findings the way the Vulnerability Management table does
  • Hand a selected image off to sysdig-remediate

This skill does not open pull requests, apply fixes, or create tickets. Use sysdig-remediate for that work.

sysdig-remediate

Remediates a specific vulnerable container image and delivers the fix. This is the only skill in the vulnerability workflow that creates tickets.

The skill can:

  • Retrieve Critical and High CVEs from Sysdig
  • Identify a safe fix version through dependency chain analysis
  • Check existing jobs, tickets, and pull requests first, so that work already in progress is not duplicated
  • Open a pull request or merge request in GitHub or GitLab, or generate a .patch file for a local repository
  • Create or update the corresponding Jira ticket
  • Record artifacts on the remediation job and close the job once the work is filed

sysdig-posture

Authors Sysdig Secure Posture custom controls and custom policies.

The skill can:

  • Author Rego-based custom controls
  • Create custom policies, including grouping existing controls such as CIS into a policy of your own
  • Validate Rego
  • Generate Terraform using the Sysdig Terraform provider
  • Discover existing policies and controls

API access is read-only. All configuration changes are managed through Terraform.

sysdig-runtime-investigate

Investigates runtime threats detected by Sysdig.

The skill can:

  • Surface the highest-priority runtime threat
  • Enumerate the affected container images
  • Score correlations between vulnerabilities and runtime activity on a confidence scale of 1 to 5
  • Analyze network blast radius, or perform VirusTotal lookups for suspicious binaries, depending on the class of event
  • Reconstruct the affected workload’s commands, network connections, and file accesses as a timeline around the detection
  • Escalate the investigation to Jira or PagerDuty

sysdig-runtime-remediate

Responds to a runtime threat that Sysdig has detected.

The skill can:

  • Turn the context gathered during an investigation into proposed response actions
  • Analyze the blast radius on the affected workload
  • Isolate, stop, or pause an affected container
  • Carry out or file the actions you approve, one at a time and with explicit confirmation

Limitations

  • Claude Code is the primary supported AI coding agent, and the skills are optimized for its capabilities.
  • Other MCP-compatible agents, including Cursor, OpenAI Codex, and OpenCode, can use the skills through the npx skills CLI command, but are not officially supported at this time.