armoctl-attack-chains
Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal. Use when the user wants to understand how vulnerabilities chain into reachable exploit paths.
Install
With your agent
Install OMGSkills skill "armosec/armoctl:skills/armoctl-attack-chains" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-attack-chains ~/.claude/skills/armoctl-attack-chainsFrom README
armoctl-attack-chains An attack chain links a posture weakness, a vulnerable component, and runtime context into a sequence an attacker could traverse. List view shows the highest-severity chains; details show the per-step evidence. Commands fields — Print the attack chains resource cheatsheet list — List attack chains Resource fields attack-chains | Field | Description | |---|---| | name | Attack chain name. | | guid | Stable identifier. | | creationTime | RFC3339 first-seen time. | | severity | Severity bucket. | | clusterName | Cluster name. | | namespace | Kubernetes namespace. | Field semantics severity — Chain severity — reflects the worst-case step in the chain. Use to prioritise which chains to investigate first. Recipes List active attack chains
More from this repo
armoctl
ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
armoctl-cloud-accounts
Cloud account onboarding — list/connect/disconnect ECS accounts.
armoctl-incidents
ARMO runtime incidents — list active threats, fetch alerts on a single incident, explain an incident's signal,...