By sysdig
Sysdig's cloud security expertise, packaged as agent skills that work natively in your AI environment.
Investigate vulnerable images in a Sysdig-monitored environment. Fetches and ranks images by risk, lets the user choose a focus (zero-day, critical in-use, exposed, all), builds a remediation plan, optionally creates a tracking ticket (Jira / Linear / GitHub Projects) using Sysdig-side signals to determine the assignee, and hands off to /sysdig-remediate. Triggers on: "investigate", "what should I fix", "show me vulnerable images", "prioritize vulnerabilities", "/sysdig-investigate".
Interactive onboarding assistant for Sysdig Secure. Guides users through connecting AWS, GCP, or Azure cloud accounts, Kubernetes clusters, or Linux hosts to Sysdig. Presents security capabilities in plain language instead of jargon. Supports guided (interview) and autonomous (all-at-once) modes. Generates Terraform or Helm configurations, validates prerequisites, deploys, and verifies connectivity.
Author Sysdig Secure Posture custom controls (Rego) and custom policies, and emit Terraform using the Sysdig provider. API access is read-only: discover supported resource kinds, validate Rego, list policies / controls. All writes happen through Terraform, never through the API.
Remediate a vulnerable container image by fetching its Critical/High CVEs from Sysdig, resolving safe fix versions through chain analysis, and producing the minimal patch (Dockerfile base bump or dependency upgrade) against the source — opens a PR/MR on GitHub or GitLab, or emits a .patch file when the user provides a local folder. Source access is mandatory. If an existing ticket key is passed in, updates that ticket with the PR link; this skill never creates new tickets — ticket creation lives in /sysdig-investigate. Persists image-to-repo mappings, PR reviewer history, and version chains across sessions.
Investigate a runtime threat detected by Sysdig end-to-end. Surfaces the highest-priority threat, enumerates affected images, scores vulnerability vs runtime correlations on a 1-5 confidence scale, deep-dives into network blast radius or suspicious-binary VT lookups depending on the event class, and hands the case off to Jira or PagerDuty. Triggers on: "investigate runtime threat", "what is this Falco alert", runtime incident triage, SOC investigation, Falco alert analysis.
Requires secrets
Needs API keys or credentials to function
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Sysdig's cloud security expertise, packaged as agent skills that work natively in your AI environment.
Headless Cloud Security brings Sysdig's runtime-grounded security knowledge directly into Claude, so security teams can onboard, investigate, and operate cloud security workflows without leaving their AI environment.
Built for enterprises that have adopted coding agents as part of their standard toolchain, Headless Cloud Security packages over a decade of cloud security expertise as reusable skills covering environment onboarding, vulnerability management, risk analysis, and runtime threat investigation. Every action is designed to keep humans in control, with structured logging for full auditability.
Sysdig's runtime layer, powered by Falco, provides the high-fidelity, deterministic signals that make agent-driven security workflows trustworthy. The platform adapts to how your security program operates, not the other way around.
Thank you for downloading the Public Beta/early preview release of the Sysdig Headless Cloud Security plugin (the “Plugin”). Customer’s use of the Plugin is voluntary and at Customer’s sole discretion. Customer use is subject to these Public Beta Terms (the “Terms”).
By downloading, installing, or using the Plugin, Customer represents and agrees that:
Customer acknowledges and agrees that Customer is solely responsible for: (i) reviewing, validating, monitoring, and supervising all outputs, decisions, recommendations, and actions generated or taken by the Plugin; and (ii) ensuring the accuracy, completeness, legality, appropriateness, and security of any resulting outputs, actions, or downstream effects.
The Plugin is provided “as is” and “as available,” without warranties of any kind, and Customer assumes all risks arising from or related to its download, installation, use, outputs, and operation.
Once installed, describe what you need in plain language. Examples:
pip install needed)Skills auto-discover Sysdig credentials from your environment. Export them in your shell profile:
export SYSDIG_SECURE_URL="https://us2.app.sysdig.com" # your Sysdig region URL
export SYSDIG_SECURE_API_TOKEN="your-api-token"
Sysdig region URLs:
| Region | URL |
|---|---|
| US East (us1) | https://secure.sysdig.com |
| US West — Oregon (us2) | https://us2.app.sysdig.com |
| US West — GCP (us3) | https://app.us3.sysdig.com |
| US West — GCP Dallas (us4) | https://app.us4.sysdig.com |
| EU Central — Frankfurt (eu1) | https://eu1.app.sysdig.com |
| EU North — Stockholm (eu2) | https://app.eu2.sysdig.com |
| AP Sydney (au1) | https://app.au1.sysdig.com |
| AP Mumbai (in1) | https://app.in1.sysdig.com |
| ME South — Dammam (me2) | https://app.me2.sysdig.com |
Never paste credentials in chat. Skills read them from environment variables only.
/plugin marketplace add sysdig/skills
/plugin install headless-cloud-security@sysdig-skills
The marketplace install loads everything automatically: the plugin skills, the Sysdig MCP server (.mcp.json), and any per-skill MCP server dependencies declared in agents/*.yaml.
npx claudepluginhub sysdig/skills --plugin headless-cloud-securitySkills and plugins to accelerate security workflows with the Orca Cloud Platform
Find security misconfigurations
Cybersecurity skills for AI agents — code audit, cloud, recon, IR, AI security, and more
Prowler for Claude Code — cloud security and compliance skills powered by the Prowler MCP server. Bundles compliance triage and remediation; more skills coming.
Claude plugins for SentinelOne XDR - threat detection, incident response, and endpoint agent management via the Purple AI MCP server
cnspec agent skills for MQL development and policy navigation