ClawHub
Back to skill

Security audit

Kubernetes RBAC Audit

Security checks across malware telemetry and agentic risk

Overview

This is a Kubernetes RBAC audit skill that uses disclosed, mostly read-only cluster queries and a local report script, with the main caution being sensitive cluster-wide access.

Install only if you are authorized to audit the target Kubernetes cluster. Prefer a short-lived, dedicated read-only kubeconfig with access limited to RBAC resources, service accounts, pods, and audit logs, and treat generated reports as sensitive because they reveal cluster permissions and workload security posture.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
76% confidence
Finding
The skill is presented as RBAC auditing, but later steps expand into pod security, privileged containers, root execution, token mounting, and kubeaudit checks unrelated to RBAC alone. This scope drift is risky because users may invoke the skill expecting narrowly scoped RBAC review while it performs broader cluster security assessment and potentially collects more sensitive workload data than necessary.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.