From subimage-mcp
Audit the current repo for cloud / SaaS providers that are NOT yet wired into SubImage, then check whether the SubImage compliance framework is enabled and surface its top actionable findings. Use when the user asks to "improve SubImage coverage", "what should I connect to SubImage", "audit cartography coverage", "what's missing in my SubImage setup", or runs this on a recurring schedule against their IaC repo. Closes the loop between "I have IaC defining X" and "SubImage tells me what's wrong with X".
How this skill is triggered — by the user, by Claude, or both
Slash command
/subimage-mcp:improve-cartography-coverageThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Three passes:
Three passes:
subimageListModules to compute coverage gaps and link them to the right setup skill.This is the bridge between IaC reality and SubImage observability. Most other skills assume the wiring is already done; this one finds the wiring that is missing and the findings that prove it would have been worth doing.
✅ User opens this skill in their IaC or scripts repo and wants a coverage audit. ✅ User just enabled a new module and wants to know which findings now light up. ✅ User wants this on a recurring cadence (weekly scheduled agent on the IaC repo). ✅ Onboarding of a new tenant: catches what was forgotten.
❌ User wants to actually connect a specific module: this skill diagnoses; the subimage-setup:connect-<module> skills do the work. This skill should hand off.
subimageListModules, subimageListFrameworks, subimageListRules, subimageGetRuleFindings).Build a set detected_providers from these signals. They are read-only; nothing here mutates the repo.
Terraform providers (strongest signal):
grep -rEho 'provider[[:space:]]+"(aws|google|azurerm|github|kubernetes|okta|cloudflare|tailscale|datadog|gitlab|slack|pagerduty|sentry|cloudflare|snowflake|vercel|sentinelone|crowdstrike)"' \
--include='*.tf' . 2>/dev/null \
| sort -u
Terraform provider name → SubImage module slug:
| Provider | Module slug |
|---|---|
aws | aws |
google | gcp |
azurerm | azure |
github | github |
gitlab | gitlab |
kubernetes (private endpoint) | implies eks + connect-kubernetes-outpost |
okta | okta |
cloudflare | cloudflare |
tailscale | tailscale |
datadog | none yet (note as "no SubImage module") |
slack | slack |
pagerduty | pagerduty |
sentry | sentry |
vercel | vercel |
sentinelone | sentinelone |
crowdstrike | crowdstrike |
CLI / environment signals (weaker, but useful when no IaC):
ls ~/.aws/config 2>/dev/null && echo "aws cli configured"
ls ~/.config/gcloud/configurations/ 2>/dev/null | head && echo "gcloud configured"
kubectl config get-contexts 2>/dev/null | tail -n +2 | awk '{print $2}' | sort -u
gh auth status 2>/dev/null | grep -E 'Logged in to' || true
git remote -v 2>/dev/null | awk '{print $2}' | sort -u # github.com / gitlab.com / bitbucket.org / ghe host
Manifest signals (optional, only if there are package manifests in the repo):
package.json deps containing @slack/web-api, octokit, @datadog/... → reinforces those providers.requirements.txt / pyproject.toml containing boto3, google-cloud-*, azure-mgmt-* → reinforces cloud providers.Treat manifest hits as additive but lower-confidence than Terraform providers.
subimageListModules()
Build set enabled_modules from rows where the module is enabled (configured and connected, not just listed).
coverage_gaps = detected_providers \ enabled_modules
For each gap, classify:
aws, gcp, azure, github, kubernetes/EKS-private (outpost). Link directly to the matching subimage-setup:connect-<module> skill (loaded by the SubImage marketplace plugin).https://app.subimage.io/docs/modules/<module>.datadog. Note it without a link.Also note the inverse: modules enabled in SubImage that you do NOT see in the repo. Usually fine (they may be wired elsewhere), but worth flagging if it is something the user clearly does not own anymore.
subimageListFrameworks()
Find the entry whose slug or display name is subimage (or "SubImage"). Three cases:
subimageListRules(framework="<subimage-framework-slug>")
Filter to rules with findingsCount > 0. Take the top 5 by:
detected_providers OR a provider just promoted out of the gap list)For each top rule:
subimageGetRuleFindings(rule_id="<rule-id>")
Capture: a few representative resources (with entity tags), severity, account or project distribution.
Use this exact structure:
# SubImage coverage audit: <repo path or org name>
## Coverage gaps (detected here, not enabled in SubImage)
- **<provider>** → <Tier 1 link to setup skill> *(recommended next step)*
- **<provider>** → <Tier 2 link to docs>
- **<provider>** → no SubImage module yet, skip
If empty: "No coverage gaps detected. Every provider this repo touches is enabled in SubImage."
## Enabled but not detected here
- <module>: enabled in SubImage but not visible in this repo. (Usually fine; just confirm ownership.)
If empty: omit this section.
## SubImage framework status
- Status: <enabled / disabled / not available>
- <one-line action if disabled or missing>
## Top actionable findings (SubImage framework, if enabled)
1. <rule title>: <count> findings, severity <X>
- hot resources: [[entity:<Label>:<id>|<short>]] (+<rest>)
- tied to: <provider> *(newly detected: yes/no)*
- next step: <one line>
2. ...
## Recommended actions (ranked)
1. <action with the highest expected leverage, usually closing the most impactful gap>
2. ...
If the top recommended action is "connect provider X" and a Tier 1 setup skill exists, offer to load it:
Want me to walk through
subimage-setup:connect-<module>now? It will ask for the values it needs (tenant id, account ids, etc.) and produce the Terraform / CloudFormation / CLI snippets.
Do not auto-load. The user opts in.
boto3 in a requirements file does not mean AWS is in production; Terraform provider "aws" does.subimage-mcp:triage-new-findings.subimageListModules directly; it is the canonical source.subimageReadMe): Domain 5 "Compliance & Security Findings", Domain 7 "Cloud CLI Command Generation" (for verification).subimage-setup:connect-aws, subimage-setup:connect-gcp, subimage-setup:connect-azure, subimage-setup:connect-github, subimage-setup:connect-kubernetes-outpost.subimage-mcp:triage-new-findings.Guides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.
npx claudepluginhub subimagesec/skills --plugin subimage-mcp