skills.rest
subimagesec
subimagesecOFFICIAL
Explore all skills by this author →
Website𝕏@subimagesecGitHub

investigate-container

Trace container image provenance and audit Kubernetes cluster internet exposure.

Updated Apr 30, 2026
Search Tags:#kubernetes#containers#eks#vulnerability analysis#cypher#image provenance#cluster exposure
One-click install
npx skills add https://github.com/subimagesec/skills --skill investigate-container
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: investigate-container
Source: https://github.com/subimagesec/skills/tree/main/plugins/subimage-mcp/skills/investigate-container
Command: npx skills add https://github.com/subimagesec/skills --skill investigate-container

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Investigate where container images run, what a Kubernetes or EKS cluster exposes to the internet, and why cluster node counts can look incorrect in SubImage.

Core Features & Use Cases

  • Image provenance: Trace an image from digest or tag to its registry repository, running workloads, source repository, and known vulnerabilities.
  • Cluster exposure auditing: Review internet-facing services, ingress resources, public-IP backing nodes, and all objects flagged as exposed to the internet.
  • Node reconciliation: Separate running EC2 instances from terminated or stopped instances that still appear linked to an EKS cluster.
  • Use case: Ask where a specific image runs, audit the attack surface of cluster X, or explain why an EKS node count is inflated.

Quick Start

Use the investigate-container skill to trace an image, audit a cluster’s exposure, or reconcile EKS node counts from the details you provide.

Frequently Asked Questions about investigate-container

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I trace a container image to its running workloads and known vulnerabilities?▼

Trace container image provenance by querying the digest or tag to map its registry repository, running workloads, source repository, and known vulnerabilities using schema-validated graph queries for reliable security analysis.

How do I audit what a Kubernetes cluster exposes to the internet?▼

Audit Kubernetes cluster exposure by reviewing internet-facing services, ingress resources, public-IP backing nodes, and all objects flagged as exposed to the internet using mode-specific workflows.

Why does my EKS cluster show an inflated node count?▼

EKS node count inflation occurs when terminated or stopped EC2 instances still appear linked to the cluster; running-instance filtering separates active nodes from stale instances for accurate reconciliation.

Can I investigate EKS node inventory without including stopped instances?▼

Yes, investigate-container applies running-instance filtering to separate running EC2 instances from terminated or stopped instances, ensuring your EKS node inventory reflects only active cluster nodes.

How does image provenance tracing work in SubImage?▼

Image provenance tracing works by applying schema-validated graph queries to follow an image from its digest or tag through the registry repository to source repositories and running workloads, linking known vulnerabilities.

What is the best way to reconcile stale EKS nodes during a security analysis?▼

The best way to reconcile stale EKS nodes is using mode-specific workflows with running-instance filtering to distinguish active EC2 instances from terminated ones, ensuring accurate cluster exposure audits.

Related Skills

Explore More Software Engineering Skills→
devkenidevkeni
1

container-security

Scan Docker images, audit Kubernetes clusters, and monitor container runtimes for security weaknesses.

Community
Advanced
Patasse97Patasse97

cloud-security

Analyze cloud misconfigurations across AWS, Azure, and GCP with MITRE mappings.

Community
Advanced
iceflowericeflower
1

karpenter-providers

Install and manage Karpenter on AWS EKS, Azure AKS, and GCP GKE.

Community
Advanced
ObolNetworkObolNetwork
10

obol-stack

Monitor Obol Stack Kubernetes pods, logs, services, and deployments via the Kubernetes API.

Official
Intermediate