armoctl-vulns
ARMO vulnerability triage — list CVEs, find affected images/hosts/workloads, check runtime relevance, manage exception policies. Use when the user is investigating package vulnerabilities, container CVEs, or remediation prioritization.
Install
With your agent
Install OMGSkills skill "armosec/armoctl:skills/armoctl-vulns" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-vulns ~/.claude/skills/armoctl-vulnsFrom README
armoctl-vulns The vulns cluster covers the runtime + scan vulnerability surface. The most important triage axis is isRelevant: ARMO observes which packages are actually loaded in running workloads, so a Critical CVE in dormant code is a much lower priority than the same CVE in an in-use library. Always filter by isRelevant when scoping urgent work.
More from this repo
armoctl
ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
armoctl-attack-chains
Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal.
armoctl-cloud-accounts
Cloud account onboarding — list/connect/disconnect ECS accounts.