Build a Cypher query

Produce a correct Cypher query that answers the user's question, in as few tool calls as possible, using only tools the SubImage MCP server actually exposes.

Hard entry gate

• Before any schema discovery, model-query lookup, or Cypher execution, check whether a dedicated SubImage MCP tool can answer the user's exact question. If yes, do not use this skill.
• If there is already a non-empty result from Issues, Vulnerabilities, Compliance, or Attack Paths that directly answers the question: stop and answer from that result. Do not use this skill to validate, enrich, double-check, or improve confidence.
• "More graph detail might exist", "validate with Cypher", and "dedicated tool result was non-empty" are not sufficient reasons. This skill is blocked unless the user explicitly asks for graph relationships, root cause, blast radius, reachability, ownership, permissions, or absence validation.

When to use

✅ The answer requires graph traversal, joins, relationships, identity/access, reachability, blast radius, ownership, root cause, transitive reasoning, or absence validation. ✅ A graph-shaped question like "which EC2 instances have public IPs and an IAM role that can assume admin?" ✅ A dedicated MCP tool returned empty results and absence must be validated. ✅ A dedicated MCP tool returned non-empty results but is missing required fields for the user's exact question. ✅ The answer requires joining graph entities across domains and no dedicated MCP tool can answer directly.