ClawHub
Back to skill

Security audit

Kubernetes Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill fits Kubernetes cluster administration, but it can retrieve cluster access credentials and change live infrastructure without clear safeguards.

Install only in an environment where the agent is allowed to administer the target Kubernetes clusters. Before using it, require explicit confirmation of the cluster, namespace, cloud account, and intended change; treat kubeconfig output as a secret; avoid pasting it into chat or logs; prefer least-privilege and short-lived access; and review or dry-run manifests before applying, scaling, or upgrading live infrastructure.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Credential Access

High
Category
Privilege Escalation
Content
# - Network configuration
```

## Get Cluster Kubeconfig

```python
# Get kubeconfig for workload cluster
Confidence
88% confidence
Finding
The skill includes functionality specifically for retrieving a workload cluster kubeconfig, which is a credential artifact granting API access to the cluster. Even though this is a legitimate administrative use case, exposing credential retrieval in generic skill instructions creates a real risk of unauthorized access or credential leakage if invoked without strong controls.

Credential Access

High
Category
Privilege Escalation
Content
## Get Cluster Kubeconfig

```python
# Get kubeconfig for workload cluster
capi_cluster_kubeconfig_tool(name="my-cluster", namespace="default")

# Returns kubeconfig to access the cluster
Confidence
90% confidence
Finding
The explicit call to capi_cluster_kubeconfig_tool(name="my-cluster", namespace="default") demonstrates credential extraction from the management plane to access a workload cluster. In a shared or automated environment, this can facilitate lateral movement or privilege expansion if the resulting kubeconfig is exposed to unauthorized users or systems.

Credential Access

High
Category
Privilege Escalation
Content
```python
# Get kubeconfig for workload cluster
capi_cluster_kubeconfig_tool(name="my-cluster", namespace="default")

# Returns kubeconfig to access the cluster
```
Confidence
93% confidence
Finding
The documentation states that the tool returns kubeconfig to access the cluster, clearly indicating credential material is produced. This is dangerous because kubeconfig commonly contains enough authentication and endpoint information to grant direct control-plane access, making accidental disclosure highly consequential.

Credential Access

High
Category
Privilege Escalation
Content
# Get kubeconfig for workload cluster
capi_cluster_kubeconfig_tool(name="my-cluster", namespace="default")

# Returns kubeconfig to access the cluster
```

## Machines
Confidence
86% confidence
Finding
Repeated kubeconfig exposure in the skill flow reinforces credential retrieval as a routine step without associated security constraints. In agentic use, repetition increases the likelihood the model will surface or handle the credential insecurely during troubleshooting or provisioning workflows.

Credential Access

High
Category
Privilege Escalation
Content
```python
1. kubectl_apply(cluster_manifest)
2. capi_clusters_list_tool(namespace)  # Wait for Provisioned
3. capi_cluster_kubeconfig_tool(name, namespace)  # Get access
```

### Scale Workers
Confidence
91% confidence
Finding
The provisioning workflow instructs obtaining kubeconfig immediately after cluster creation as a normal step to 'Get access,' which operationalizes credential retrieval within an automated sequence. This makes the context more dangerous because it encourages end-to-end automation that may fetch and expose credentials without a separate approval or secure handling boundary.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill exposes kubeconfig retrieval and states it returns access credentials, but does not warn that kubeconfig is sensitive and may contain cluster-admin access, tokens, or certificate material. In agent workflows, this can normalize credential disclosure and lead to accidental leakage into chat history, logs, or downstream tools.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documents cluster creation, scaling, and upgrade workflows that can cause real infrastructure changes, cost increases, outages, or destructive state transitions, but it does not explicitly warn the user to confirm intent and scope before acting. In an agent setting, omission of such safeguards increases the chance of accidental high-impact operations being executed from routine prompts.

Static analysis

No suspicious patterns detected.