skills.rest
kyle9021
kyle9021COMMUNITY
Explore all skills by this author →
GitHub

trace-vm-image

Traces critical vulnerabilities on cloud VMs back to their source images and ranks images by blast radius.

3|1|Updated Sep 1, 2026
Search Tags:#vulnerability management#cloud security#blast radius#ami#cve prioritization#cspm#crowdstrike falcon
One-click install
npx skills add https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp --skill trace-vm-image-kyle9021
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: trace-vm-image
Source: https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp/tree/main/.claude/skills/trace-vm-image
Command: npx skills add https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp --skill trace-vm-image-kyle9021

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? A fleet of hundreds of vulnerable VMs is an endless patching queue, but most critical CVEs are inherited from the base image the instances booted from. This Skill identifies which small set of AWS AMIs, Azure image references, or GCP source images accounts for the largest share of critical findings, so rebuilding a few images retires the bulk of the backlog instead of patching instances one by one. ## Core Features & Use Cases - Cross-cloud image attribution: Resolves the instance-to-image chain for AWS, Azure (including the disk hop and AKS/VMSS parent lookup), and GCP using only the Falcon MCP server's vulnerability, CSPM asset, and host search tools. - Blast-radius ranking: Ranks images by public exploit availability, affected instances times distinct critical CVEs, and ExPRT critical/high counts, contrasting CVSS severity with ExPRT ratings to right-size the actual workload. - Evidence-backed dashboard: Renders a self-contained HTML report with ranked image and instance detail tables, per-cloud coverage gaps, and a full query evidence trail showing every filter executed and what it returned. - Use Case: Ask which vulnerable VM images create the most downstream exposure across your cloud estate, and receive a ranked answer such as "rebuilding 3 of 47 images retires 66% of critical findings" with the instance-level work order for the platform team. ## Quick Start Ask the assistant to find which base images are responsible for the most critical vulnerabilities across my AWS, Azure, and GCP VMs and rank them by blast radius.

Frequently Asked Questions about trace-vm-image

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find which VM images cause the most critical vulnerabilities?▼

Query Falcon Spotlight for open critical vulnerabilities with the host_info facet, resolve each instance to its base image through CSPM asset relationships, then rank images by exploit availability and affected instance count. The Skill automates this across AWS, Azure, and GCP.

How to trace an Azure or GCP VM back to its source image?▼

Azure and GCP instance records carry no image reference, so the lookup goes through the attached disk: Azure disks expose the image at properties.creationData.imageReference.id, and GCP disks carry a compute.googleapis.com/Image relationship edge. AWS resolves in one hop from the instance's own relationships.

What Falcon API scopes does cloud vulnerability tracing require?▼

It requires read-only scopes for Vulnerabilities, Cloud Security API Assets, and Hosts. Without Cloud Security API Assets access you get the vulnerability list but cannot resolve any instance to an image.

Why does my cloud vulnerability report miss an entire cloud provider?▼

Spotlight findings come from the Falcon sensor while CSPM inventory is agentless, so a cloud with instances but no sensor produces zero findings and silently drops out of grouped results. The Skill queries CSPM inventory per cloud first and reports unsensored clouds as explicit coverage gaps.

Can this Skill rebuild or patch the vulnerable images it finds?▼

No, it deliberately stops at prioritization and evidence. Image rebuilds are change-managed work owned by the platform team, so the output is a ranked recommendation with instance-level detail, owner tag keys, and rollback guidance rather than a remediation script.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

performing-aws-account-enumeration-with-scout-suite

Audit AWS account configurations with ScoutSuite to enumerate resources and identify misconfigurations.

Community
Intermediate
incidentfoxincidentfox
656

grafana-dashboards

Query Grafana dashboards, Prometheus metrics, and alerts via the Grafana API.

Official
Intermediate
braydos-hbraydos-h
4

prioritizing-vulnerabilities-with-cvss-scoring

Prioritize vulnerabilities using CVSS scores, EPSS exploit probability, and CISA KEV data.

Community
Intermediate
lloydchanglloydchang
2

orchestrate-workflows

Coordinate multi-cloud workflows across AWS, Azure, GCP, and on-prem environments.

Community
Advanced