Security audit

Kubernetes Agent Swarm

Security checks across malware telemetry and agentic risk

Overview

This Kubernetes operations skill is not clearly malicious, but it combines powerful cluster/cloud authority with overbroad git persistence and external escalation behavior that users should review first.

Install only if you intend to give an agent live Kubernetes/OpenShift authority and possibly cloud, registry, GitOps, and incident-response access. Before use, require explicit human approval for production changes, deletes, secret reads/writes, alert silences, PagerDuty/Slack/Teams messages, git commits, pushes, and PRs; scope credentials to least privilege and replace broad `git add -A` and action logging with path-limited, redacted records.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (48)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The artifact skill includes mandatory session procedures to read repository-wide files and perform git commits, which exceed the stated artifact-management scope. This broadens the agent’s accessible data surface and grants persistent modification capability across the workspace, increasing the chance of unrelated data exposure or unauthorized changes if the skill is invoked in a sensitive repo.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill embeds generic human communication and PagerDuty escalation behavior that goes beyond artifact lifecycle operations and enables outbound transmission of operational details. In practice, this can leak sensitive environment, incident, or image metadata to third-party systems without clear scoping, approval, or data-minimization controls.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to read and modify arbitrary local repository files, update tracking documents, and perform git commits as a mandatory session workflow even though the skill's stated purpose is cluster operations. This unnecessarily expands the skill's authority from infrastructure operations into persistent local codebase modification, creating opportunities for unauthorized file changes, data tampering, or persistence in the repository.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill adds outbound human communication and PagerDuty API interaction capabilities that are not essential to basic cluster operations and can exfiltrate operational context, incident details, or sensitive metadata to external systems. Embedding these capabilities in the skill broadens the attack surface and can enable unauthorized notifications or data disclosure if the agent is misled or compromised.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The document claims it does not handle security policies, yet it includes security-sensitive actions such as RBAC assignment, namespace access management, pull secret creation, and service account modification. This mismatch can mislead operators and downstream agents about the skill’s authority, increasing the risk of inappropriate execution of privileged actions without proper security review.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill includes Slack/Teams/PagerDuty messaging and escalation workflows that extend beyond core GitOps cluster management into external communications and incident orchestration. This broadens the skill’s authority and can enable unintended data exfiltration, social engineering, or autonomous escalation using external services if invoked inappropriately.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill adds direct AWS Secrets Manager and Azure Key Vault administration instructions, which exceed normal GitOps deployment responsibilities and grant access to sensitive secret-management operations. Expanding scope in this way increases the blast radius from deployment management to secret creation, retrieval, and rotation across cloud providers.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill claims an observability/triage role but includes Grafana dashboard creation and update operations that modify remote state. This expands the agent from read-only monitoring into configuration management, which can unintentionally alter dashboards, mislead operators, or be abused to push unauthorized changes.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The Alertmanager silence example and cloud alert/resource modification guidance give the observability agent the ability to suppress alerts or alter monitoring coverage. An attacker or mistaken operator could hide active incidents, delay detection, or reduce visibility during an outage.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The incident response section instructs containment and fix actions such as rollback, scaling, and redirecting traffic, which exceed pure observability and enter operational control. This increases the chance that an observability-focused agent could take disruptive production actions without the safeguards expected for deployment or infrastructure tooling.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The file explicitly says Pulse does not manage deployments or infrastructure, yet later sections prescribe operational changes and state-modifying actions. This contradiction is dangerous because downstream agents or users may trust the declared scope while the actual instructions authorize broader, riskier behavior.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The session management section adds repository navigation, file reading, and mandatory git commit behavior unrelated to observability analysis. This broadens the agent's reach into source control and local data persistence, creating opportunities to expose, persist, or modify sensitive operational information.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: PagerDuty triggering introduces an outbound notification capability not declared in the required credentials/capabilities section. Hidden or undeclared external integrations are risky because they can send incident metadata off-system and may be invoked without operators understanding the data-sharing or escalation implications.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill states the orchestrator should only coordinate work, but later instructs it to modify the repository, create branches, push commits, and open PRs itself. This expands the agent’s authority beyond its declared role and can cause unintended codebase changes or unauthorized workflow execution, especially if triggered automatically from log content.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: Although the orchestrator claims it does not directly operate clusters, it is instructed to query cluster state and verify access using kubectl/oc. Direct cluster interaction increases blast radius and undermines separation of duties, particularly because the skill is granted KUBECONFIG-based access credentials.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The file contains contradictory guidance: it says the orchestrator should only assign and track work, but later gives it direct operational tasks. Such contradictions are dangerous because agents may follow the more concrete operational steps, bypassing intended controls and role boundaries.

Context-Inappropriate Capability

Low

Confidence: 78% confidence
Finding: The skill introduces outbound communication and incident-escalation integrations not declared in the manifest scope or requirements. Hidden or under-documented external communications can leak operational context, create unreviewed side effects, and make it harder for users to understand what the agent may send externally.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill broadens from Kubernetes security operations into generic local workspace management, including reading local files and committing changes to git. In an agent setting, this scope expansion can cause unintended modification of repository state and exposure of unrelated local data, especially because these actions are framed as mandatory session behavior rather than narrowly scoped security tasks.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest describes a cluster security specialist, but the body adds outbound communication capabilities to Slack, Teams, and PagerDuty that are not declared in the metadata. This hidden expansion of exfiltration and notification scope is dangerous because an agent could transmit operational or security-sensitive details to third-party services without the user's explicit understanding.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill includes direct HTTP submission to PagerDuty even though its stated scope is cluster security guidance, not external incident dispatch. This creates an unnecessary outbound action path that could be abused to exfiltrate details, trigger false incidents, or cause operational disruption through unauthorized paging.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instruction to append every agent action to a persistent audit log creates a real risk of sensitive data exposure because it does not prohibit logging secrets, tokens, kubeconfigs, credential material, or confidential operational details. In a Kubernetes/OpenShift operations skill, agents frequently handle high-value data and cluster-wide actions, so broad logging guidance without redaction rules can lead to long-lived leakage of credentials and security-sensitive context.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The Artifactory example uses direct credentials in a curl command without warning about shell history, logs, or process-list exposure. Even as documentation, this normalizes unsafe secret handling and could cause users or agents to expose tokens during execution or transcript capture.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The Harbor API examples also place username/password material directly on the command line with no user-facing warning. This increases the likelihood of credential leakage through audit logs, terminal recording, shared shell history, or system process inspection.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The ACR credential retrieval command explicitly fetches registry credentials but provides no warning that the output is sensitive or should be tightly handled. This can lead to accidental disclosure in consoles, CI logs, transcripts, or follow-on automation.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The ECR login example pipes an authorization token into docker login without any warning about handling resulting credentials or avoiding logging around the command. While common, documenting it without safeguards can still cause token or stored credential exposure in shared environments.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: skills/observability/SKILL.md:542