Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-container-drift-at-runtimenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-container-drift-at-runtime -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-container-drift-at-runtime -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-container-drift-at-runtimegh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-container-drift-at-runtimegit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-container-drift-at-runtime ~/.claude/skills/detecting-container-drift-at-runtime # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-container-drift-at-runtime ~/.agents/skills/detecting-container-drift-at-runtime # Codex, Cursor, Gemini CLI, Copilot, OpenCode