SubImage Skills

Agent skills marketplace for SubImage, the cloud-native security platform. The same skills work in Claude Code, Codex, Cursor, and other Agent Skills clients.

Install

Claude Code

claude plugin marketplace add subimagesec/skills
claude plugin install subimage-setup@subimage
claude plugin install subimage-mcp@subimage

Codex

codex plugin marketplace add subimagesec/skills
codex
# then run /plugins and install subimage-setup and/or subimage-mcp

Cursor

Preferences -> Cursor Settings -> Rules, Skills, Subagents
New -> Import from GitHub/GitLab
https://github.com/subimagesec/skills

Plugins

subimage-setup

Onboarding recipes for SubImage data sources from your IaC or CLI environment. No SubImage tenant connection required to generate the IaC code.

connect-aws Deploy SubImageScanRole via CloudFormation StackSet, Terraform, or aws-cli.
connect-gcp Create the org-level service account and grant the IAM read roles via Terraform or gcloud.
connect-azure Create a service principal with Reader on subscriptions or a Management Group via Terraform or az.
connect-kubernetes-outpost Deploy the SubImage Outpost (Helm or Docker) so SubImage can reach private APIs.
connect-github Install the SubImage GitHub App, or wire a PAT for GitHub Enterprise Server.
connect-declarative-schema Bring custom context (service catalogs, ownership, CMDB) into the graph: JSONL data, YAML schema, and S3 or GCS plumbing.

subimage-mcp

Operator workflows over the SubImage MCP server. See the MCP setup docs.

triage-new-findings Findings digest grouped by tag/theme (rules listed directly), with recommended next steps.
investigate-cve Full impact, EPSS/KEV context, and fixability for a specific CVE, with opt-in internet enrichment and a pivot to attack-path exploration.
investigate-package Trace a package from issue/CVE to image layer, classify base-image versus app origin, and assess runtime reachability.
investigate-iam IAM privilege audit: admin-equivalent identities, assume-role and cross-account trust chains, PermissionSet effective permissions.
investigate-container Image provenance, Kubernetes/EKS cluster exposure, and EKS node-count reconciliation (three modes).
investigate-ip Resolve IP/domain ownership across cloud resources, trace the DNS chain, and attribute public IPs (ASN/geo/VPN-proxy-Tor).
investigate-public-exposure Explain why a resource is public or internet-exposed, including CloudFront/S3 versus direct bucket policy causes.
review-attack-path Walk an attack path step by step, hunt for n+1 extensions, propose the fastest fix.
improve-subimage-coverage Scan the current repo for providers, cross-reference with subimageListModules, then list rules with findings and surface the top actionable ones grouped by tag.
inventory-via-cypher List, count, filter, or break down one resource type with a single Cypher query: on its ontology label across every provider, or on the provider-native label when you name a specific product such as RDS or EKS.
signals-via-cypher Answer findings, compliance, vulnerability, package, and attack-path questions with one Cypher query on the Signal nodes that hold them.
build-cypher-query Construct a verified Cypher query against the SubImage Neo4j graph by exploring the schema and validating with bounded probes.
create-custom-rule Draft, validate against the live tenant graph, and persist a tenant-local custom Cypher rule.
identify-iac-repositories Identify and rank the repositories that manage Infrastructure as Code, gated on enabled modules and grouped by confidence.

Marketplace catalog

The Claude Code catalog is at /.claude-plugin/marketplace.json. The Codex catalog is at /.agents/plugins/marketplace.json.