kubectl

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

This is a straightforward kubectl skill, but it can change live Kubernetes clusters or expose sensitive configuration if used carelessly.

Install only where the agent is allowed to operate kubectl. Use a least-privilege kubeconfig, verify the active cluster context and namespace, require approval for apply/delete/scale/drain/exec/port-forward actions, prefer localhost port-forwarding, and do not paste raw kubeconfig, secrets, tokens, or sensitive logs into chat or tickets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/REFERENCE.md:410

Finding

Pod Port Forwarding May Expose Internal Services on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: references/REFERENCE.md, line 410
Vulnerability Type: Unsafe network service exposure
Risk Level: Medium

Vulnerable Code

bash

kubectl port-forward pod/POD --address 0.0.0.0 8080:8080  # All IPs

Technical Analysis

The documented command binds the forwarded Kubernetes pod port to 0.0.0.0, causing it to listen on every network interface of the local host. Unlike the safer default loopback binding, this can make an internal workload reachable by other systems on the local network or, depending on routing and firewall configuration, from the Internet.

kubectl port-forward does not add application authentication or network access controls. If the forwarded service is an administrative interface, metrics endpoint, debugging service, or unauthenticated internal API, anyone able to connect to the host's port 8080 may interact with it.

Attack Path

1. An operator follows the documented command to access an internal pod.
2. kubectl binds port 8080 to all host interfaces.
3. The host firewall or surrounding network allows another system to reach that port.
4. An attacker discovers or is informed of the exposed port.
5. The attacker connects to the forwarded endpoint and interacts directly with the pod service.
6. If the service lacks effective authentication, the attacker accesses data or performs operations available through that service.

Impact Assessment

The accessible privileges are determined by the forwarded application. Potential impact includes unauthorized access to internal APIs, administrative dashboards, debugging endpoints, operational metrics, or application data. The exposure remains active while the port-forward process runs and is limited by host firewall rules, network reachability, and application-level authentication.

Remediation

View remediation

Remediation Suggestions

• Use the default loopback binding or specify it explicitly:

  bash

  kubectl port-forward pod/POD --address 127.0.0.1 8080:8080
  

• Remove the globally bound example from the general command reference.
• If remote access is necessary, require explicit operator approval and document the associated exposure.
• Restrict access with host firewall rules and trusted source-address allowlists.
• Require strong application authentication and TLS for any service intentionally exposed beyond localhost.
• Stop the port-forward process immediately after the diagnostic or administrative task is complete.

T09 · Insecure Skill Coding Practices

Note

• Location: references/REFERENCE.md:139

Finding

Inline Kubernetes Secret Values May Leak Through Shell and Process Metadata

Content

View full analysis

Vulnerability Details

File Location: references/REFERENCE.md, line 139
Vulnerability Type: Sensitive value supplied through command-line arguments
Risk Level: Low

Vulnerable Code

bash

kubectl create secret generic my-secret --from-literal=key=value  # Secret

Technical Analysis

The command encourages operators to replace value with a real secret directly in a command-line argument. Depending on the execution environment, the resulting command can be retained in shell history, terminal logs, audit telemetry, support bundles, or automation logs. The argument may also be visible to process-inspection mechanisms while the command runs.

Although the example contains only placeholders, following this pattern with production credentials can create additional plaintext copies outside Kubernetes.

Attack Path

1. An operator replaces the placeholder with an application password, API key, or another production secret.
2. The operator executes the command in an interactive shell or logged automation environment.
3. The command and inline secret are recorded in shell history, process telemetry, audit records, or job output.
4. A local user or log reader with access to that record retrieves the secret.
5. The exposed value is reused against the associated application or external service.

Impact Assessment

Impact depends on the secret placed in the command. Exposure could permit access to application accounts, databases, external APIs, or other services protected by the credential. This command does not itself grant additional Kubernetes privileges; compromise is constrained by the authority of the exposed secret and by an attacker's access to local history or telemetry.

Remediation

View remediation

Remediation Suggestions

• Prefer reading secret material from a protected file rather than placing it directly in the command:

  bash

  kubectl create secret generic my-secret --from-file=key=/secure/path/secret
  

• Create temporary files with restrictive permissions such as mode 0600, and securely remove them after use.
• Avoid printing commands containing secrets in CI/CD logs or shell tracing output.
• Disable or carefully control shell history when an inline value is unavoidable.
• Restrict access to terminal recordings, audit logs, process telemetry, and automation output.
• Add an explicit warning to the reference that --from-literal values may be retained in command history.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/REFERENCE.md:374

Finding

Kubernetes Bearer Token May Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: references/REFERENCE.md, line 374
Vulnerability Type: Kubernetes credential exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

bash

kubectl config set-credentials USER --token=TOKEN  # Create user

Technical Analysis

The documented pattern places a Kubernetes bearer token directly in the command line. When a real token replaces the placeholder, it can be retained in shell history, terminal capture, audit telemetry, automation logs, or process metadata. A bearer token can generally be used by anyone who obtains it until it expires or is revoked.

The command also stores the supplied token in kubeconfig as part of its intended operation. That file must therefore be protected with strict filesystem permissions.

Attack Path

1. An operator replaces TOKEN with a valid Kubernetes bearer token.
2. The operator runs the command in a shell or automation job.
3. The token is retained in command history, execution logs, process telemetry, or an inadequately protected kubeconfig file.
4. An attacker with local or log-reading access obtains the token.
5. The attacker uses the token with kubectl or the Kubernetes API server.
6. The attacker performs every cluster operation permitted by the token's RBAC assignments until the credential expires or is revoked.

Impact Assessment

The attacker's effective privileges are those assigned to the token's Kubernetes identity. Impact can range from read-only access within one namespace to modification of workloads, access to Kubernetes Secrets, pod execution, or cluster-wide administration. The exact scope depends on RBAC configuration, token lifetime, API-server reachability, and any additional admission controls.

Remediation

View remediation

Remediation Suggestions

• Avoid documenting production bearer tokens as literal command-line arguments.
• Prefer short-lived credentials obtained through a supported authentication plugin or exec credential provider.
• Protect kubeconfig files with restrictive permissions, normally mode 0600, and limit access to the owning account.
• Prevent command tracing and log capture around credential-management operations.
• If a token may have been exposed, revoke or rotate it immediately and review Kubernetes API audit logs.
• Apply least-privilege RBAC and short token expiration periods to reduce the impact of disclosure.
• Add a prominent warning explaining that inline tokens can be recorded in shell history and telemetry.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 120)May include surrounding context.

md

## Environment Variables

- `KUBECONFIG` — Path to kubeconfig file (can include multiple paths separated by `:`)
- `KUBECTLDIR` — Directory for kubectl plugins (optional)

## Documentation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md

## Environment Variables

- `KUBECONFIG` — Path to kubeconfig file (can include multiple paths separated by `:`)
- `KUBECTLDIR` — Directory for kubectl plugins (optional)

## Documentation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md

author: Dennis de Vaal <[e-mail]>
  version: "1.0.0"
  keywords: "kubernetes,k8s,container,docker,deployment,pods,cluster"
compatibility: Requires kubectl binary (v1.20+) and active kubeconfig connection to a Kubernetes cluster. Works on macOS, Linux, and Windows (WSL).
---

# kubectl Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 120)May include surrounding context.

md

author: Dennis de Vaal <[e-mail]>
  version: "1.0.0"
  keywords: "kubernetes,k8s,container,docker,deployment,pods,cluster"
compatibility: Requires kubectl binary (v1.20+) and active kubeconfig connection to a Kubernetes cluster. Works on macOS, Linux, and Windows (WSL).
---

# kubectl Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

author: Dennis de Vaal <[e-mail]>
  version: "1.0.0"
  keywords: "kubernetes,k8s,container,docker,deployment,pods,cluster"
compatibility: Requires kubectl binary (v1.20+) and active kubeconfig connection to a Kubernetes cluster. Works on macOS, Linux, and Windows (WSL).
---

# kubectl Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

author: Dennis de Vaal <[e-mail]>
  version: "1.0.0"
  keywords: "kubernetes,k8s,container,docker,deployment,pods,cluster"
compatibility: Requires kubectl binary (v1.20+) and active kubeconfig connection to a Kubernetes cluster. Works on macOS, Linux, and Windows (WSL).
---

# kubectl Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

author: Dennis de Vaal <[e-mail]>
  version: "1.0.0"
  keywords: "kubernetes,k8s,container,docker,deployment,pods,cluster"
compatibility: Requires kubectl binary (v1.20+) and active kubeconfig connection to a Kubernetes cluster. Works on macOS, Linux, and Windows (WSL).
---

# kubectl Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

author: Dennis de Vaal <[e-mail]>
  version: "1.0.0"
  keywords: "kubernetes,k8s,container,docker,deployment,pods,cluster"
compatibility: Requires kubectl binary (v1.20+) and active kubeconfig connection to a Kubernetes cluster. Works on macOS, Linux, and Windows (WSL).
---

# kubectl Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

author: Dennis de Vaal <[e-mail]>
  version: "1.0.0"
  keywords: "kubernetes,k8s,container,docker,deployment,pods,cluster"
compatibility: Requires kubectl binary (v1.20+) and active kubeconfig connection to a Kubernetes cluster. Works on macOS, Linux, and Windows (WSL).
---

# kubectl Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md

author: Dennis de Vaal <[e-mail]>
  version: "1.0.0"
  keywords: "kubernetes,k8s,container,docker,deployment,pods,cluster"
compatibility: Requires kubectl binary (v1.20+) and active kubeconfig connection to a Kubernetes cluster. Works on macOS, Linux, and Windows (WSL).
---

# kubectl Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

## Prerequisites

1. **kubectl binary** installed and accessible on PATH (v1.20+)
2. **kubeconfig** file configured with cluster credentials (default: `~/.kube/config`)
3. **Active connection** to a Kubernetes cluster

## Quick Setup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

kubectl config view can display kubeconfig contents, including cluster endpoints, usernames, client certificate data, tokens, or exec-based auth configuration depending on environment. In an agent skill context, documenting credential-revealing commands without warning is dangerous because users may paste the output into chat or logs, causing accidental credential disclosure.

Content

Scanner excerpt · references/REFERENCE.md (reported line 347)May include surrounding context.

Configuration Management

kubeconfig Commands

bash

kubectl config view                                # Show kubeconfig
kubectl config view --flatten                      # Flatten (merge)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

kubectl config view --flatten is especially sensitive because it produces a merged, self-contained kubeconfig that may inline certificate authority data, client certificate data, and keys, making accidental disclosure more severe. Within a skill meant to guide users interactively, omission of any disclosure warning increases the chance of exfiltrating reusable access material.

Content

Scanner excerpt · references/REFERENCE.md (reported line 349)May include surrounding context.

kubeconfig Commands

bash

kubectl config view                                # Show kubeconfig
kubectl config view --flatten                      # Flatten (merge)
kubectl config view --minify                       # Minimal

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/REFERENCE.md (reported line 360)May include surrounding context.

kubectl config get-contexts # List contexts kubectl config use-context CONTEXT # Switch context kubectl config set-context CONTEXT --cluster=CLUSTER --user=USER # Create context kubectl config delete-context CONTEXT # Delete context kubectl config rename-context OLD NEW # Rename context

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown includes commands that apply configuration and scale deployments on a Kubernetes cluster, which can change running workloads and affect availability. The surrounding documentation presents these as basic commands but does not warn users that they modify live cluster state or recommend verifying the target context/namespace first.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill enables networked interaction with a Kubernetes API server through kubectl but does not declare any explicit tool scope or permission boundaries. In an agent setting, this can cause the agent to perform sensitive cluster operations without clear authorization constraints or user visibility into the level of access required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The overview advertises high-impact actions such as create, patch, scale, drain, and taint management without an explicit warning that these operations can disrupt workloads or alter production systems. In a reusable agent skill, normalizing destructive operations without safety messaging increases the chance of accidental misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The node drain example instructs eviction of all pods from a node but does not warn about service disruption, PodDisruptionBudget interactions, or the risk to singleton workloads and local data. If followed blindly, this can trigger outages during maintenance or destabilize cluster capacity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The bulk delete example shows label-based pod deletion without a warning that it can remove many workloads at once and potentially cause downtime or loss of ephemeral state. In an agent context, broad selectors make accidental overreach more likely and more damaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The reference includes commands such as listing secrets, viewing pod YAML, showing kubeconfig, and setting credentials, all of which can reveal sensitive values or authentication material. The markdown does not warn users that output may contain secrets, tokens, cluster endpoints, or other confidential configuration details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown reference lists commands for deleting resources, forcing pod deletion, draining nodes, and other cluster-modifying operations, but it does not provide explicit safety warnings about data loss, service disruption, or confirming the target context before execution. Because this is a command reference that users may copy directly, omission of such warnings increases the risk of accidental destructive use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The documentation includes kubectl exec -it POD_NAME -- /bin/bash, which grants shell access inside a running container and can expose or alter application data. There is no nearby warning about sensitivity, required authorization, or the risk of making in-container changes during troubleshooting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.