sysdig-investigate
Investigate and prioritize vulnerable images in a Sysdig-monitored environment via two flows, routed from the user's goal. Plans flow — plan-driven prioritization: pick an admin-configured Plan (or explore ranked jobs under an ad-hoc scope and measure) and walk the prioritized remediation jobs one at a time. Findings flow — ad-hoc findings analysis: filter, regroup, sort, and page vulnerability findings the way the Vulnerability Management UI table does. Hands any chosen image off to /sysdig-remediate, which owns tickets, PRs, job tracking, and job closing. Triggers on: "investigate", "what should I fix", "what should I fix first", "show me my vulnerable images", "prioritize vulnerabilities", "which images are affected by CVE-...", "show me all Critical CVEs in production", "/sysdig-investigate". Not for opening PRs, applying fixes, or creating/updating tickets — use /sysdig-remediate for all of those.
Pinned to revision 03cadb82f5a2, so it is the text this page describes rather than whatever the author pushed since.
Pre-approved tools experimental
Experimental field. Support varies between clients, so this list is what the author declared, not what your client will enforce.
- AskUserQuestion
- Read
- Write
- mcp__secure-mcp-server__get_customer_settings
- mcp__secure-mcp-server__get_skill_state
- mcp__secure-mcp-server__save_skill_state
- mcp__secure-mcp-server__delete_skill_state
- mcp__secure-mcp-server__list_plans
- mcp__secure-mcp-server__list_plan_remediation_jobs
- mcp__secure-mcp-server__get_plan_target_measure
- mcp__secure-mcp-server__list_plan_categories
- mcp__secure-mcp-server__list_plan_category_measures
- mcp__secure-mcp-server__list_zones
- mcp__secure-mcp-server__query_vulnerability_findings
- mcp__secure-mcp-server__explore_jobs
- mcp__secure-mcp-server__get_job_impact
- mcp__secure-mcp-server__list_artifacts
- mcp__secure-mcp-server__list_plan_activities
- mcp__secure-mcp-server__create_artifact
- mcp__secure-mcp-server__list_scope_labels
- mcp__secure-mcp-server__list_scope_label_values
- mcp__secure-mcp-server__run_sysql
- mcp__secure-mcp-server__get_plan_report_options
- mcp__secure-mcp-server__get_plan_report_data
- mcp__secure-mcp-server__save_plan_report
- mcp__secure-mcp-server__get_brand_kit
- mcp__secure-mcp-server__get_design_tokens
Files
- skills/sysdig-investigate/SKILL.md
- skills/sysdig-investigate/agents/openai.yaml
- skills/sysdig-investigate/references/agent-capabilities.md
- skills/sysdig-investigate/references/auth-preflight.md
- skills/sysdig-investigate/references/first-run-notice.md
- skills/sysdig-investigate/references/mcp-setup.md
- skills/sysdig-investigate/references/on-brand-output.md
- skills/sysdig-investigate/references/state.md
- skills/sysdig-investigate/references/sysdig-brand.md
- skills/sysdig-investigate/references/trust-preamble.md
- skills/sysdig-investigate/references/zones.md
Every link opens the file at its source, pinned to the revision this page describes.