Author Sysdig Secure Posture custom controls (Rego) and custom policies, and emit Terraform using the Sysdig provider. API access is read-only: discover supported resource kinds, validate Rego, list policies / controls. All writes happen through Terraform, never through the API.
npx claudepluginhub sysdig/skills --plugin headless-cloud-securityThis skill is limited to using the following tools:
Before doing any other work for this skill, perform this one-time check:
Interactive onboarding assistant for Sysdig Secure. Guides users through connecting AWS, GCP, or Azure cloud accounts, Kubernetes clusters, or Linux hosts to Sysdig. Presents security capabilities in plain language instead of jargon. Supports guided (interview) and autonomous (all-at-once) modes. Generates Terraform or Helm configurations, validates prerequisites, deploys, and verifies connectivity.
Audits Terraform, Kubernetes, and cloud configs against CIS, SOC 2, HIPAA using Checkov, tfsec, OPA. Generates compliance reports, remediation patches, and CI/CD gating steps.
Audits Terraform IaC for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies. Detects permissive IAM, public exposures, missing encryption before deployment.
Share bugs, ideas, or general feedback.
Before doing any other work for this skill, perform this one-time check:
If ~/.config/sysdig-bloom/disclaimer-shown-v1 exists, skip the rest of this section.
Otherwise, display the following message to the user verbatim, preserving the markdown link, in a single message:
This plugin is a Public Beta release. It is provided “as is” and “as available,” without warranties of any kind. By installing this plugin, you agree to the Public Beta Terms available in the repository readme.
Create the marker file ~/.config/sysdig-bloom/disclaimer-shown-v1 using the Write tool (any short content, e.g. the current UTC timestamp). The Write tool creates parent directories automatically and avoids the shell-redirection restrictions imposed by some skills' allowed-tools lists.
Then continue with the user's request.
When you need to ask the user a question, get confirmation, or present choices, use the AskUserQuestion tool if available. This ensures proper rendering across all agent clients.
Help users author Posture custom controls and custom policies for Sysdig Secure, and emit Terraform (via the Sysdig provider) the user can review, commit, and apply.
SYSDIG_SECURE_API_TOKEN and SYSDIG_SECURE_URL..tf. Read the file and pass its content to the test_posture_rego MCP tool to validate. Show diffs and test results in chat, not the full Rego each turn.terraform apply and terraform destroy require explicit user confirmation. init, plan, validate, and read-only MCP tool calls run proactively.>, >>, |, or 2>&1 in Bash tool calls — they break allowed-tools matching.Verify that the Sysdig MCP server is available by checking that the get_customer_settings tool exists. If it is not available, stop and output the message below verbatim — do not paraphrase, expand, restructure, or drop sentences:
Sysdig MCP server isn't reachable (the tool
get_customer_settingsis missing). To register it in Claude Code:claude mcp add sysdig -- npx -y @sysdig/secure-mcp-serverSet
SYSDIG_SECURE_API_TOKENandSYSDIG_SECURE_URLfirst, then re-run/sysdig-posture. For other agents (Cursor, Codex, OpenCode) and troubleshooting:references/mcp-setup.md.
Do not proceed until the MCP server is reachable. The same env vars are picked up by the Sysdig Terraform provider, so once the MCP check passes, terraform plan/apply will authenticate from the same place.
Run scripts/validate_prereqs.sh before starting. It checks the local tooling needed for the Terraform path:
If ok is false, surface the install command for each entry in missing and stop.
The Sysdig Terraform provider needs credentials at plan/apply time. They can come from the agent's shell (SYSDIG_SECURE_URL + SYSDIG_SECURE_API_TOKEN) or from an existing provider "sysdig" block already wired up in the user's IaC repo (tfvars-driven, vault-backed, etc.). MCP availability does not imply env vars are exported locally — the MCP server may be remote and hold its own credentials.
Probe both env vars without leaking the token value:
echo "${SYSDIG_SECURE_URL:+SET}"
echo "${SYSDIG_SECURE_API_TOKEN:+SET}"
SET → proceed.provider "sysdig" block that handles credentials its own way:
versions.tf will be skipped at the generation step if their versions.tf already exists.export the missing variable in the shell where Terraform will run, then re-probe. Never accept a token in chat.After prerequisites are OK, ask the user what they want to do. Use AskUserQuestion with these options:
input per resource kind family, idioms, limitations.terraform apply, direct the user to assign the policy to a zone via Policies → Posture Policies → [policy name] → Zones in the Sysdig Secure UI.