Skip to content

sysdig/headless-cloud-security

v0.4.2

Sysdig's cloud security expertise, packaged as agent skills that work natively in your AI environment.

GitHubOpen Website
skills

sysdig-runtime-remediate

Close the runtime loop on a Sysdig-detected threat: turn the investigation context into proposed response actions, analyse the blast radius on the affected workload, and execute (or file) the actions the user approves — one at a time, with explicit confirmation. Triggers: "remediate this runtime threat", "respond to event <id>", "act on this incident", "isolate / kill / pause that container", "/sysdig-runtime-remediate". Not for vulnerability fixes (use sysdig-remediate) or threat investigation itself (use sysdig-runtime-investigate).

Read SKILL.md at the source

Pinned to revision 03cadb82f5a2, so it is the text this page describes rather than whatever the author pushed since.

Pre-approved tools experimental

Experimental field. Support varies between clients, so this list is what the author declared, not what your client will enforce.

  • Read
  • Write
  • Glob
  • Grep
  • AskUserQuestion
  • Bash(command -v*)
  • Bash(kubectl get*)
  • Bash(kubectl describe*)
  • Bash(kubectl logs*)
  • Bash(kubectl version*)
  • Bash(kubectl config current-context*)
  • Bash(kubectl auth can-i*)
  • Bash(kubectl patch*)
  • Bash(kubectl label*)
  • Bash(kubectl annotate*)
  • Bash(kubectl scale*)
  • Bash(kubectl delete networkpolicy*)
  • Bash(kubectl rollout*)
  • Bash(aws sts get-caller-identity*)
  • Bash(aws iam get-role*)
  • Bash(aws iam list-*)
  • Bash(aws iam get-role-policy*)
  • Bash(aws iam get-access-key-last-used*)
  • Bash(aws cloudtrail lookup-events*)
  • Bash(aws iam attach-role-policy*)
  • Bash(aws iam detach-role-policy*)
  • Bash(aws iam delete-access-key*)
  • Bash(aws iam update-access-key*)
  • Bash(curl *events.pagerduty.com*)
  • mcp__secure-mcp-server__list_runtime_events
  • mcp__secure-mcp-server__get_event_info
  • mcp__secure-mcp-server__get_event_process_tree
  • mcp__secure-mcp-server__run_sysql
  • mcp__secure-mcp-server__get_customer_settings
  • mcp__secure-mcp-server__list_response_actions
  • mcp__secure-mcp-server__submit_response_action
  • mcp__secure-mcp-server__get_response_action_status
  • mcp__secure-mcp-server__list_response_action_executions
  • mcp__secure-mcp-server__undo_response_action
  • mcp__secure-mcp-server__get_capture_storage
  • mcp__atlassian__getVisibleJiraProjects
  • mcp__atlassian__createJiraIssue

Files

Every link opens the file at its source, pinned to the revision this page describes.