Cluster API Lifecycle Management

• Outcome: Pass
• Latest audit: Oct 22, 2026 · 2:56 PM UTC
• Version: 2.0.0

Overview

The skill describes standard Kubernetes cluster management tasks, with expected credential access and infrastructure changes and no evidence of hidden behavior.

Connect only the intended management cluster with limited permissions. Review the target, manifests, replica counts and versions before changes, since provisioning, scaling and upgrades can affect costs or interrupt workloads. Keep returned cluster credentials private.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

| 1 | Detect CAPI installation first | CRITICAL | `detect_ecosystem` |
| 2 | Check cluster phase before operations | HIGH | `capi_get_cluster` |
| 3 | Monitor machines during scaling | HIGH | `capi_list_machines` |
| 4 | Get kubeconfig after provisioning | MEDIUM | `capi_get_cluster_kubeconfig` |

## Quick Reference

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

| 1 | Detect CAPI installation first | CRITICAL | `detect_ecosystem` |
| 2 | Check cluster phase before operations | HIGH | `capi_get_cluster` |
| 3 | Monitor machines during scaling | HIGH | `capi_list_machines` |
| 4 | Get kubeconfig after provisioning | MEDIUM | `capi_get_cluster_kubeconfig` |

## Quick Reference

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

|------|------|---------|
| Detect CAPI | `detect_ecosystem` | `detect_ecosystem()` |
| List clusters | `capi_list_clusters` | `capi_list_clusters(namespace)` |
| Get cluster kubeconfig | `capi_get_cluster_kubeconfig` | `capi_get_cluster_kubeconfig(name, namespace)` |
| Scale workers | `capi_scale_machinedeployment` | `capi_scale_machinedeployment(name, namespace, replicas)` |

## Check Installation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

|------|------|---------|
| Detect CAPI | `detect_ecosystem` | `detect_ecosystem()` |
| List clusters | `capi_list_clusters` | `capi_list_clusters(namespace)` |
| Get cluster kubeconfig | `capi_get_cluster_kubeconfig` | `capi_get_cluster_kubeconfig(name, namespace)` |
| Scale workers | `capi_scale_machinedeployment` | `capi_scale_machinedeployment(name, namespace, replicas)` |

## Check Installation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

|------|------|---------|
| Detect CAPI | `detect_ecosystem` | `detect_ecosystem()` |
| List clusters | `capi_list_clusters` | `capi_list_clusters(namespace)` |
| Get cluster kubeconfig | `capi_get_cluster_kubeconfig` | `capi_get_cluster_kubeconfig(name, namespace)` |
| Scale workers | `capi_scale_machinedeployment` | `capi_scale_machinedeployment(name, namespace, replicas)` |

## Check Installation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

Get Cluster Kubeconfig

python

# Get kubeconfig for workload cluster
capi_get_cluster_kubeconfig(name="my-cluster", namespace="default")

# Returns kubeconfig to access the cluster

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Get kubeconfig for workload cluster

capi_get_cluster_kubeconfig(name="my-cluster", namespace="default")

Returns kubeconfig to access the cluster

text

## Machines

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

- Network configuration

text

## Get Cluster Kubeconfig

```python
# Get kubeconfig for workload cluster

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

python

# Get kubeconfig for workload cluster
capi_get_cluster_kubeconfig(name="my-cluster", namespace="default")

# Returns kubeconfig to access the cluster

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

python

1. kubectl_apply(cluster_manifest)
2. capi_list_clusters(namespace)  # Wait for Provisioned
3. capi_get_cluster_kubeconfig(name, namespace)  # Get access

Scale Workers

The standalone trigger "machine" can activate the skill outside Kubernetes Cluster API contexts.

Medium

• Category: Trigger Abuse
• Confidence: 98% confidence

Finding

The skill activates when the user mentions "machine", a common term that also describes local computers, virtual machines, and machine learning. This trigger has no explicit requirement for Cluster API context or exclusions for unrelated uses.

Content

No source excerpt is available for this finding.

Infrastructure-changing workflows lack warnings about costs and workload disruption.

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

The skill's own workflows instruct the agent to provision clusters, change worker counts, and update control-plane and worker versions. There is no warning that provisioning or scaling can change cloud costs, or that scaling down and upgrading can remove or replace nodes and disrupt workloads; monitoring instructions do not disclose these impacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.