K8s Ops Fix

• Outcome: Review
• Latest audit: Jun 17, 2026 · 5:53 AM UTC
• Version: 2.1.1

Overview

This Kubernetes operations plugin appears purpose-aligned, but its guides encourage broad cluster-admin access and other live-cluster changes without enough scoping or safeguards.

Install only if you intend to give the agent real Kubernetes operational authority. Use a dedicated least-privilege kubeconfig, avoid cluster-admin except for explicit break-glass cases, verify current context and namespace before any write action, review remote manifests before applying them, and avoid storing raw SSH passwords in plugin configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The guide instructs users to bind the plugin ServiceAccount to the built-in cluster-admin role, which grants unrestricted control over the entire cluster. For an operations plugin, this is an overly broad default that violates least-privilege and materially increases blast radius if the plugin, its credentials, or the host environment are compromised.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The plugin is presented as a Kubernetes operations skill, but its configuration schema also solicits SSH host details including passwords and private key paths for a separate sys-monitor capability. Expanding the trust boundary from Kubernetes API access to arbitrary SSH access materially increases credential exposure and lateral-movement risk, especially when the extra capability is not clearly justified by the stated skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The troubleshooting guide recommends creating a ClusterRoleBinding to grant cluster-admin for routine RBAC troubleshooting. This is excessive privilege escalation guidance that could lead operators to grant full cluster-wide administrative access unnecessarily, greatly increasing blast radius if misused or copied into production workflows.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The installation instructions direct users to create a ClusterRoleBinding to cluster-admin without any warning that this grants full administrative control over the cluster. Omitting that warning makes unsafe deployment more likely and can normalize excessive privilege in production environments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The quickstart includes mutating Kubernetes operations such as scaling, changing images, and rolling back deployments without any warning that these commands affect live workloads. In a quickstart context, users may copy-paste them into production clusters, causing service disruption, unintended rollouts, or rollback of critical applications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quickstart instructs users to expose a deployment as a LoadBalancer service without warning that this may create externally reachable infrastructure and publicly expose the application. In many cloud environments, this can open network access, incur cost, and unintentionally publish an insecure default service to the internet.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The guide includes cluster-modifying operations such as blue/green traffic switching and canary-related service patching without prominent warnings to verify the active context, namespace, target service selector, or production impact first. In a Kubernetes operations skill, these commands are likely to be copied verbatim, so an operator can unintentionally redirect live traffic or alter the wrong cluster, causing outage or misrouting.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document tells users to apply a manifest directly from a remote GitHub raw URL without instructing them to review, pin, or verify the content first. This creates a supply-chain and trust-on-first-use risk: if the remote content changes, is compromised, or is unavailable, users may deploy unexpected cluster-wide resources into sensitive environments.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The bulk restart script restarts every Deployment returned by the current `kubectl` scope, but the guide does not warn that this may affect all applications in the current namespace or context. In a cluster-operations plugin, this is especially dangerous because users may run it against production or the wrong cluster, causing widespread service disruption, cascading restarts, and avoidable downtime.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document includes high-impact RBAC privilege-granting commands without warning that they provide cluster-wide administrative access. In a Kubernetes operations skill, users are likely to copy/paste such commands during incidents, which can normalize dangerous privilege escalation and create persistent overprivileged identities.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The guide instructs users to copy a kubeconfig into `~/.kube/config` and set `KUBECONFIG` without warning that this changes active cluster credentials and may overwrite an existing configuration. This can cause accidental access changes, credential mix-ups, or unintended operations against the wrong cluster.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.