Security audit
Security checks across malware telemetry and agentic risk
This Kubernetes skill is a disclosed local operations helper that keeps cluster notes on the user's machine and avoids storing credentials.
Install only if you are comfortable with the agent keeping local Kubernetes operational notes under `~/Clawic/data/`, including cluster topology, hostnames, RBAC gaps, incident history, and runbooks. Keep that directory private, review it periodically, and do not paste secrets unless you are relying on the skill's redaction rules.
- ~/clawic/k8s/ --- **Data.** At the start of every session, read `~/Clawic/data/k8s/config.yaml` (what the user declared) and `~/Clawic/data/k8s/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names the moment the condition on its line applies — that index is the list of files that exist, never a list you carry in your head. Check `## Due` against today's date and state any overdue item in one line: a statement, not a question. Read `~/Clawic/data/servers/servers.md` before any capacity, sizing, upgrade, or "what do we run" question. If none of it exists, work from defaults and say nothing about it. If data sits at an old location (`~/k8s/` or `~/clawic/k8s/`), move it to `~/Clawic/data/k8s/`, and say in one line that you moved it and from where. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. **Write before the session ends** whenever it produced something durable: a cluster discovered, upgraded or retired; a workload sized from real observation; an incident whose cause was finally named; a deploy with its rollback digest; a drill that was timed; an audit finding the user chose to accept; a hostname the cluster now serves; or anything they will want to read again — a runbook, a policy or manifest that finally worked, an architecture decision. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.
