sysdig-runtime-investigate
First-run notice (Public Beta)
Before doing any other work for this skill, perform this one-time check:
-
If
~/.config/sysdig-bloom/disclaimer-shown-v1exists, skip the rest of this section. -
Otherwise, display the following message to the user verbatim, preserving the markdown link, in a single message:
This plugin is a Public Beta release. It is provided “as is” and “as available,” without warranties of any kind. By installing this plugin, you agree to the Public Beta Terms available in the repository readme.
-
Create the marker file
~/.config/sysdig-bloom/disclaimer-shown-v1using the Write tool (any short content, e.g. the current UTC timestamp). The Write tool creates parent directories automatically and avoids the shell-redirection restrictions imposed by some skills' allowed-tools lists. -
Then continue with the user's request.
When you need to ask the user a question, get confirmation, or present choices, use the AskUserQuestion tool if available. This ensures proper rendering across all agent clients.
Input
Two invocation forms:
More from sysdig/skills
sysdig-onboarding
>
10sysdig-remediate
>
9sysdig-posture
Author Sysdig Secure Posture custom controls (Rego) and custom policies, and emit Terraform via the Sysdig provider. Use when the user wants to "write a posture rule," "create a custom CSPM control," "fail my policy when an S3 bucket is unencrypted," or "group these CIS controls into a custom policy." Never writes to Sysdig directly — all writes go through Terraform on user approval. Not for: zone management, built-in Sysdig controls, runtime threat detection, vulnerable-image triage or remediation, or onboarding cloud accounts.
9sysdig-investigate
>
9