# armoctl-attack-chains

> Claude/Codex skill by [@armosec](https://omgskills.com/library/armosec/index.md) · 0 stars · Updated 2026-10-22

Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal. Use when the user wants to understand how vulnerabilities chain into reachable exploit paths.

## Install

```sh
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-attack-chains ~/.claude/skills/armoctl-attack-chains
```

## From README

armoctl-attack-chains An attack chain links a posture weakness, a vulnerable component, and runtime context into a sequence an attacker could traverse. List view shows the highest-severity chains; details show the per-step evidence. Commands fields — Print the attack chains resource cheatsheet list — List attack chains Resource fields attack-chains | Field | Description | |---|---| | name | Attack chain name. | | guid | Stable identifier. | | creationTime | RFC3339 first-seen time. | | severity | Severity bucket. | | clusterName | Cluster name. | | namespace | Kubernetes namespace. | Field semantics severity — Chain severity — reflects the worst-case step in the chain. Use to prioritise which chains to investigate first. Recipes List active attack chains

## Links

- HTML page: https://omgskills.com/library/armosec/armoctl/skills/armoctl-attack-chains/
- GitHub: https://github.com/armosec/armoctl
- Author: [@armosec](https://omgskills.com/library/armosec/index.md)

## More from this repo

- [armoctl](https://omgskills.com/library/armosec/armoctl/skills/armoctl/index.md) — ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
   - [@armosec](https://omgskills.com/library/armosec/index.md) · 0 stars
- [armoctl-cloud-accounts](https://omgskills.com/library/armosec/armoctl/skills/armoctl-cloud-accounts/index.md) — Cloud account onboarding — list/connect/disconnect ECS accounts.
   - [@armosec](https://omgskills.com/library/armosec/index.md) · 0 stars
- [armoctl-incidents](https://omgskills.com/library/armosec/armoctl/skills/armoctl-incidents/index.md) — ARMO runtime incidents — list active threats, fetch alerts on a single incident, explain an incident's signal,...
   - [@armosec](https://omgskills.com/library/armosec/index.md) · 0 stars