Updated 4w ago
by sysdig
skills
Sysdig agentic AI skills and plugins
62 GitHub stars (62)
+2 in 16 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | +1 |
| Oct 3 | 0 |
| Oct 4 | 0 |
| Oct 5 | 0 |
| Oct 6 | 0 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | 0 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | 0 |
| Oct 14 | 0 |
| Oct 15 | 0 |
| Oct 16 | +1 |
- 8 skills (8 skills found in its SKILL.md files)
- 1 forks (1 forks)
- 4w ago last update (Last updated 4w ago)
Install
Skills CLI
npx skills add sysdig/skills
Asks which skills and agents to install. Just one: npx skills add sysdig/skills --skill sysdig-account-setup — add -g for every project.
Claude Code
git clone https://github.com/sysdig/skillscp -r "skills/skills/sysdig-account-setup" ~/.claude/skills/
Copies the sysdig-account-setup skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add sysdig/skills
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
sysdig-account-setup
Baseline account setup for Sysdig Secure after a tenant is connected. Guided, interactive, modular setup via the Sysdig MCP server: (1) access baseline — teams, users, and roles; (2) vulnerability management policy baseline — Pipeline vs runtime, one policy or split; (3) compliance standards — assign posture policies (CIS, PCI, NIST, …) to zones; (4) runtime threat-detection — enable/disable the…
skills/sysdig-account-setup/SKILL.md on GitHub (opens in a new tab) -
sysdig-investigate
Investigate and prioritize vulnerable images in a Sysdig-monitored environment via two flows, routed from the user's goal. Plans flow — plan-driven prioritization: pick an admin-configured Plan (or explore ranked jobs under an ad-hoc scope and measure) and walk the prioritized remediation jobs one at a time. Findings flow — ad-hoc findings analysis: filter, regroup, sort, and page vulnerability f…
skills/sysdig-investigate/SKILL.md on GitHub (opens in a new tab) -
sysdig-onboarding
Interactive onboarding assistant for Sysdig Secure. Guides users through connecting AWS, GCP and Azure cloud accounts, Kubernetes clusters (including Windows nodes), and Linux hosts to Sysdig, plus serverless workload scanning (AWS ECS/Fargate, AWS Lambda, GCP Cloud Run). Presents security capabilities in plain language instead of jargon. Supports guided (interview) and autonomous (all-at-once) m…
skills/sysdig-onboarding/SKILL.md on GitHub (opens in a new tab) -
sysdig-posture
Author Sysdig Secure Posture custom controls (Rego) and custom policies, and emit Terraform via the Sysdig provider. Use when the user wants to "write a posture rule," "create a custom CSPM control," "fail my policy when an S3 bucket is unencrypted," or "group these CIS controls into a custom policy." Never writes to Sysdig directly — all writes go through Terraform on user approval. Not for: zon…
skills/sysdig-posture/SKILL.md on GitHub (opens in a new tab) -
sysdig-remediate
Remediate one specific vulnerable container image and deliver the fix as a PR/MR, a tracking ticket, or both — this skill is the sole ticket creator in the Sysdig vulnerability workflow. Deduplicates existing work (job artifacts, Sysdig-created Jira tickets, external tickets and PRs) read-only, fetches Critical/High CVEs from Sysdig, resolves a safe fix version via chain analysis, opens a PR/MR (…
skills/sysdig-remediate/SKILL.md on GitHub (opens in a new tab) -
sysdig-runtime-investigate
Use this skill when investigating a runtime threat detected by Sysdig end-to-end. Surfaces the highest-priority threat, scores vulnerability vs runtime correlations on a 1-5 confidence scale, deep-dives into network blast radius or suspicious-binary VirusTotal lookups depending on the event class, reconstructs the affected workload's activity audit trail (commands, connections, file accesses) as…
skills/sysdig-runtime-investigate/SKILL.md on GitHub (opens in a new tab) -
sysdig-runtime-remediate
Close the runtime loop on a Sysdig-detected threat: turn the investigation context into proposed response actions, analyse the blast radius on the affected workload, and execute (or file) the actions the user approves — one at a time, with explicit confirmation. Triggers: "remediate this runtime threat", "respond to event <id>", "act on this incident", "isolate / kill / pause that container", "/s…
skills/sysdig-runtime-remediate/SKILL.md on GitHub (opens in a new tab) -
sysdig-sysql
SysQL query language reference for Sysdig Secure. Use when writing, debugging, or explaining SysQL graph queries against the Sysdig security datastore. Triggers on: SysQL queries, Sysdig inventory/vulnerability/posture/identity/runtime queries, "write a SysQL query", "query sysdig for", "find vulnerable images", "show me workloads", or any task involving MATCH/RETURN syntax against Sysdig entitie…
skills/sysdig-sysql/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.
Similar skills
-
superpowersby obra An agentic skills framework & software development methodology that works.
-
skillsby mattpocock Skills for Real Engineers. Straight from my .agents directory.
-
ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod…
-
reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries.
-
andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.
-
skillsby anthropics Public repository for Agent Skills