armoctl-seccomp
Generated seccomp profiles — list and generate profiles per workload. Use to restrict syscalls to those observed at runtime.
Install
With your agent
Install OMGSkills skill "armosec/armoctl:skills/armoctl-seccomp" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-seccomp ~/.claude/skills/armoctl-seccompFrom README
armoctl-seccomp Same model as network-policies but for seccomp: ARMO records the syscall set at runtime and emits a tight allow-list profile. Commands fields — Print the seccomp profiles resource cheatsheet generate — Generate seccomp profiles for specified workloads Flags: --wlid (stringSlice) Workload ID (repeatable, required) list — List seccomp profiles Resource fields profiles | Field | Description | |---|---| | name | Profile name. | | namespace | Kubernetes namespace. | | cluster | Cluster name. | | kind | Resource kind. | | containerName | Container the profile applies to. | Field semantics containerName — Container the profile applies to. Profiles are container-level, which is more precise than pod-level but requires one profile per container. Recipes Generate a seccomp profile for a workload
More from this repo
armoctl
ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
armoctl-attack-chains
Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal.
armoctl-cloud-accounts
Cloud account onboarding — list/connect/disconnect ECS accounts.