Security audit
Security checks for vulnerabilities and agentic risk
This Kubernetes multi-cluster skill is coherent and not malicious, but it needs review because it normalizes handling cluster credentials, secrets, and production-changing operations without enough guardrails.
Review before installing in environments with real cluster access. Only use it with least-privilege Kubernetes credentials, require explicit target-context confirmation before mutating operations, avoid copying secrets across trust boundaries, and treat any retrieved kubeconfig as a sensitive credential that should be redacted, protected, short-lived, and cleaned up when no longer needed.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Understanding Contexts
A kubeconfig context combines:
- **Cluster**: API server URL and CA certificate
- **User**: Authentication credentials
- **Namespace**: Default namespace (optional)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Understanding Contexts
A kubeconfig context combines:
- **Cluster**: API server URL and CA certificate
- **User**: Authentication credentials
- **Namespace**: Default namespace (optional)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Understanding Contexts
A kubeconfig context combines:
- **Cluster**: API server URL and CA certificate
- **User**: Authentication credentials
- **Namespace**: Default namespace (optional)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Understanding Contexts
A kubeconfig context combines:
- **Cluster**: API server URL and CA certificate
- **User**: Authentication credentials
- **Namespace**: Default namespace (optional)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Understanding Contexts
A kubeconfig context combines:
- **Cluster**: API server URL and CA certificate
- **User**: Authentication credentials
- **Namespace**: Default namespace (optional)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Different files per environment
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Different files per environment
export KUBECONFIG=~/.kube/production.yaml
export KUBECONFIG=~/.kube/development.yaml
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Different files per environment
export KUBECONFIG=~/.kube/production.yaml
export KUBECONFIG=~/.kube/development.yaml
Retrieving a workload cluster kubeconfig via Cluster API can expose highly privileged access material if mishandled, and the example immediately suggests using it to access the workload cluster. In a multi-cluster management skill, this is more sensitive because fetched kubeconfigs may grant broad administrative access across environments if stored, logged, or shared insecurely.
# List CAPI-managed clusters
capi_clusters_list_tool(namespace="capi-system")
# Get workload cluster kubeconfig
kubeconfig = capi_cluster_kubeconfig_tool(
name="workload-cluster-1",
namespace="capi-system"
The assignment of the returned kubeconfig to a variable reflects active retrieval of cluster access credentials, which carries real exposure risk if later printed, stored, or reused improperly. Because this skill is specifically about switching among many clusters, accidental credential spread or privilege escalation is more plausible than in generic documentation.
capi_clusters_list_tool(namespace="capi-system")
# Get workload cluster kubeconfig
kubeconfig = capi_cluster_kubeconfig_tool(
name="workload-cluster-1",
namespace="capi-system"
)
The instruction to save the kubeconfig to a file and add it to contexts encourages persistence of sensitive cluster credentials without mentioning access controls, expiration, or cleanup. That can leave privileged kubeconfigs on disk and broaden long-term access to workload clusters, especially dangerous in a multi-cluster admin workflow.
namespace="capi-system" )
The skill explicitly advertises retrieval of a workload cluster kubeconfig, which is a credential-bearing artifact that can grant cluster access if mishandled. In a multi-cluster management skill, access tokens or client certs for workload clusters are especially sensitive because compromise can expand attacker reach across environments.
capi_cluster_get_tool(name="prod-cluster", namespace="capi-system")
### Get Workload Cluster Kubeconfig
capi_cluster_kubeconfig_tool(name="prod-cluster", namespace="capi-system")
This line documents direct use of a tool that returns cluster kubeconfig material, creating a clear path to credential disclosure if the output is shown, stored, or transferred insecurely. Because the skill is intended for multi-cluster operations, leaked kubeconfigs could enable unauthorized movement between clusters or compromise production environments.
capi_cluster_kubeconfig_tool(name="prod-cluster", namespace="capi-system")
The documentation presents cross-cluster secret synchronization as a normal workflow without any caution about secret sensitivity, destination validation, or environment boundaries. In a multi-cluster Kubernetes skill, this can normalize copying credentials between clusters and increase the chance of propagating production secrets into less trusted environments or the wrong target cluster.
The rolling deployment example performs sequential production changes across multiple clusters but omits any warning about production impact, approval gates, rollback planning, or confirmation before proceeding. In a context-switching skill, that omission is risky because it can encourage operators or agents to execute broad production changes quickly and across the wrong contexts.
The skill includes scaling and deployment-oriented examples such as changing machine deployment replica counts and cluster-targeted Helm/GitOps actions without explicitly warning that these operations can alter live infrastructure or cause service disruption. In a multi-cluster context, this is more dangerous because the same action may accidentally be applied to production, amplifying operational impact.
The secret synchronization example demonstrates reading secrets from one cluster and applying them to another without any warning about secret exposure, least-privilege handling, or cross-environment propagation risks. This is dangerous because it normalizes copying sensitive credentials across trust boundaries, which can leak production secrets into less secure clusters or logs.
No suspicious patterns detected.