investigate-container

Name: investigate-container
Availability: InStock
Author: SubImage

Trace container image provenance and audit Kubernetes cluster internet exposure.

Updated Apr 30, 2026

Search Tags:#kubernetes #containers #eks #vulnerability analysis #cypher #image provenance #cluster exposure

Ready to run

npx skills add https://github.com/subimagesec/skills --skill investigate-container

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: investigate-container
Source: https://github.com/subimagesec/skills/tree/main/plugins/subimage-mcp/skills/investigate-container
Command: npx skills add https://github.com/subimagesec/skills --skill investigate-container

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Investigate where container images run, what a Kubernetes or EKS cluster exposes to the internet, and why cluster node counts can look incorrect in SubImage.

Core Features & Use Cases

Image provenance: Trace an image from digest or tag to its registry repository, running workloads, source repository, and known vulnerabilities.
Cluster exposure auditing: Review internet-facing services, ingress resources, public-IP backing nodes, and all objects flagged as exposed to the internet.
Node reconciliation: Separate running EC2 instances from terminated or stopped instances that still appear linked to an EKS cluster.
Use case: Ask where a specific image runs, audit the attack surface of cluster X, or explain why an EKS node count is inflated.

Quick Start

Use the investigate-container skill to trace an image, audit a cluster’s exposure, or reconcile EKS node counts from the details you provide.

Frequently Asked Questions about investigate-container

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I trace a container image to its running workloads and known vulnerabilities?▼

Trace container image provenance by querying the digest or tag to map its registry repository, running workloads, source repository, and known vulnerabilities using schema-validated graph queries for reliable security analysis.

How do I audit what a Kubernetes cluster exposes to the internet?▼

Audit Kubernetes cluster exposure by reviewing internet-facing services, ingress resources, public-IP backing nodes, and all objects flagged as exposed to the internet using mode-specific workflows.

Why does my EKS cluster show an inflated node count?▼

EKS node count inflation occurs when terminated or stopped EC2 instances still appear linked to the cluster; running-instance filtering separates active nodes from stale instances for accurate reconciliation.

Can I investigate EKS node inventory without including stopped instances?▼

Yes, investigate-container applies running-instance filtering to separate running EC2 instances from terminated or stopped instances, ensuring your EKS node inventory reflects only active cluster nodes.

How does image provenance tracing work in SubImage?▼

Image provenance tracing works by applying schema-validated graph queries to follow an image from its digest or tag through the registry repository to source repositories and running workloads, linking known vulnerabilities.

What is the best way to reconcile stale EKS nodes during a security analysis?▼

The best way to reconcile stale EKS nodes is using mode-specific workflows with running-instance filtering to distinguish active EC2 instances from terminated ones, ensuring accurate cluster exposure audits.