GKE Autopilot Hardening

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:33 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward external API wrapper for generating GKE hardening configuration, with a privacy documentation gap around request identifiers but no evidence of hidden execution or unsafe local behavior.

Install only if you intend to use the referenced external hardening API. Prefer pseudonymous session IDs, avoid sending real user IDs or sensitive operational data unless the provider is approved for your environment, and review generated manifests before applying them to a GKE cluster.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The request schema collects sessionId and optional userId/timestamp fields without documenting purpose, minimization, retention, or privacy handling. In a security-focused skill, opaque collection of identifiers increases the risk of unnecessary tracking, accidental logging of sensitive metadata, and privacy noncompliance if callers send user-linked values by default.

VirusTotal

63/63 vendors flagged this skill as clean.