armoctl-runtime-policies
Runtime policies — bundles of rules attached to clusters/namespaces/workloads. Use to manage which detection rules apply where.
Install
With your agent
Install OMGSkills skill "armosec/armoctl:skills/armoctl-runtime-policies" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-runtime-policies ~/.claude/skills/armoctl-runtime-policiesFrom README
armoctl-runtime-policies A policy is a bag of runtime-rules with a binding scope (cluster, namespace, workload). When a workload runs, the union of policies that bind to it determines which rules evaluate. Commands create — Create a runtime policy Flags: --description (string) Policy description --enabled (bool) Enable the policy --name (string) Policy name (required) --policy-file (string) Path to JSON file containing the full policy body fields — Print the runtime-policies resource cheatsheet list — List runtime policies Flags: --rulesettype (string) Filter by ruleset type (Managed or Custom) update [guid] — Update a runtime policy Flags: --description (string) Policy description --enabled (string) Enable/disable the policy (true|false) --name (string) Policy name --policy-file (string) Path to JSON file containing policy updates Resource fields runtime-policies | Field | Description | |---|---| | guid | Stable policy ID. | | name | Policy name.
More from this repo
armoctl
ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
armoctl-attack-chains
Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal.
armoctl-cloud-accounts
Cloud account onboarding — list/connect/disconnect ECS accounts.