Agent Skills

Agent Skills

If you work with SubImage from a coding agent (Claude Code, Codex, Cursor, Gemini CLI, ...), you can install the SubImage skills from the subimagesec/skills marketplace to give your agent first-party recipes for both the IaC side (deploying SubImage data sources) and the runtime side (operating against the SubImage MCP server).

Agent skills are packages of instructions and reference material that coding agents load on demand. The SubImage marketplace currently ships two plugins:

  • subimage-setup: onboarding recipes for cloud and SaaS data sources from your IaC or CLI environment. Generates the Terraform / CloudFormation / Helm / aws-cli / gcloud / az / gh artifacts for AWS, GCP, Azure, GitHub, and the Kubernetes Outpost. No SubImage tenant connection required.
  • subimage-mcp: operator workflows over the SubImage MCP server. Findings triage, CVE deep dive, attack-path review, coverage audit, and ad-hoc Cypher querying. Requires an authenticated MCP connection (see Connect via MCP).

The full catalog and rendered SKILL.md files are at skills.subimage.io.

Install

Claude Code

claude plugin marketplace add subimagesec/skills
claude plugin install subimage-setup@subimage
claude plugin install subimage-mcp@subimage

After install, skills are namespaced under their plugin and are model-invocable: the agent picks the right one automatically based on the user's phrasing.

/subimage-setup:connect-aws
/subimage-setup:connect-gcp
/subimage-setup:connect-azure
/subimage-setup:connect-kubernetes-outpost
/subimage-setup:connect-github
/subimage-setup:connect-declarative-schema

/subimage-mcp:triage-new-findings
/subimage-mcp:investigate-cve
/subimage-mcp:investigate-iam
/subimage-mcp:investigate-container
/subimage-mcp:investigate-ip
/subimage-mcp:review-attack-path
/subimage-mcp:improve-subimage-coverage
/subimage-mcp:build-cypher-query
/subimage-mcp:create-custom-rule

Codex

Codex has native Agent Skills and plugin marketplace support:

codex plugin marketplace add subimagesec/skills
codex

Then run /plugins, select SubImage Skills, and install subimage-setup and/or subimage-mcp.

Codex can choose installed skills automatically from their descriptions. You can also type $ to mention one explicitly.

Cursor

Cursor has native Agent Skills. Open Cursor Settings -> Rules -> Add Rule -> Remote Rule (Github) and enter:

https://github.com/subimagesec/skills

Cursor imports the repo's Agent Skills and lists them under Agent Decides.

Other agents (Gemini CLI, ...)

The marketplace also follows the agentskills.io standard:

npx skills add subimagesec/skills
tip

subimage-mcp skills assume the SubImage MCP server is already configured in your client. Set that up first via Connect via MCP; the skills layer recipes on top of the tools that MCP exposes.

What you get

SubImage setup

The subimage-setup plugin covers onboarding flows that an agent runs from your IaC repo:

Skill What it does
connect-aws Deploy SubImageScanRole via CloudFormation StackSet, Terraform, or aws-cli.
connect-gcp Create the org-level service account and grant the IAM read roles via Terraform or gcloud.
connect-azure Create a service principal with Reader on subscriptions or a Management Group via Terraform or az.
connect-kubernetes-outpost Deploy the SubImage Outpost (Helm or Docker) so SubImage can reach private APIs (private EKS/GKE/AKS, on-prem Jamf, etc.).
connect-github Install the SubImage GitHub App, or wire a PAT for GitHub Enterprise Server.
connect-declarative-schema Bring custom context (service catalogs, owner/team mappings, business criticality, CMDB) into the graph via the Declarative Schema module, joined against existing AWS/GCP/Azure/Identity nodes.

Every setup skill follows the same shape: it asks the agent for the required values (tenant slug, account ids, etc.), surfaces the gotchas that matter for that integration, generates the IaC or CLI artifacts, and proposes a verification command.

SubImage MCP

The subimage-mcp plugin covers recurring SubImage workflows that compose multiple MCP tools:

Skill What it does
triage-new-findings Frameworks-first findings digest with grouped themes and recommended next steps.
investigate-cve Full impact and fixability for a specific CVE, with an opt-in pivot to attack-path exploration on the affected resources.
investigate-iam IAM privilege audit covering admin-equivalent identities, assume-role chains, cross-account trust, and PermissionSet effective permissions.
investigate-container Image provenance, Kubernetes/EKS cluster exposure, and EKS node-count reconciliation.
investigate-ip Resolve IP or domain ownership across cloud resources, trace DNS, and attribute public IP context.
review-attack-path Walk an attack path step by step, hunt for credible n+1 extensions, propose the fastest fix. Optional what-if scenarios.
improve-subimage-coverage Scan the current repo for cloud and SaaS providers, cross-reference with subimageListModules, check the SubImage compliance framework, surface top actionable findings.
build-cypher-query Build and run a verified Cypher query against the SubImage Neo4j graph for cross-resource, identity, attack-surface, or ownership questions when no dedicated MCP tool fits.
create-custom-rule Draft, validate against the live tenant graph, and persist a tenant-local custom Cypher rule.

These chain into each other: investigate-cve offers to hand off to review-attack-path once it has identified affected resources, and improve-subimage-coverage proposes the matching subimage-setup skill when it detects a provider not yet wired into SubImage.

Authoring a new skill

The marketplace is a public repository; pull requests are welcome. The repo's README covers the conventions we follow:

  • One SKILL.md per skill, frontmatter with name and description, body under 500 lines.
  • Required-inputs section that asks the user explicitly rather than guessing tenant-specific values.
  • Gotchas (setup) or anti-patterns (usage) section hoisting environment facts that defy reasonable assumptions.
  • Hand-off hooks between sibling skills.

The structure follows the Agent Skills standard, with native plugin metadata layered on top for Claude Code and Codex. For description-trigger calibration, see the agentskills description optimization guide.

See also

On this page
InstallClaude CodeCodexCursorOther agents (Gemini CLI, ...)What you getSubImage setupSubImage MCPAuthoring a new skillSee also