ClawHub
Back to skill

Security audit

kubectl-mcp-server CLI

Security checks for vulnerabilities and agentic risk

Overview

This Kubernetes helper needs review because its remote-server example omits protections that restrict access to cluster-management capabilities.

Use least-privilege Kubernetes credentials and verify read-only mode for your installed version. Confirm the cluster and namespace before changes. Prefer local stdio access; configure authentication and network restrictions before enabling remote HTTP access. Add aliases and desktop integration only when wanted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The supplied commands launch server transports; none performs tool discovery, direct tool invocation, or a health check. Hosting a server, particularly an HTTP endpoint for remote clients, is a materially different capability not disclosed in the description. Debug logging is a supporting implementation detail and is not independently a mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Shows:

✓ kubectl: found

✓ helm: found

✓ kubeconfig: valid

✓ cluster: connected

text

Activation keywords are not restricted to kubectl-mcp-server tasks.

Medium
Category
Trigger Abuse
Confidence
98% confidence
Finding

The skill explicitly activates on generic terms such as "CLI", "command line", "call", "grep", and "info". Although the title identifies kubectl-mcp-server, these activation rules do not require that context or provide exclusions, so unrelated command-line requests could invoke the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

Shell Aliases

bash
# Add to ~/.bashrc or ~/.zshrc
alias kmcp='kubectl-mcp-server'
alias kmcp-tools='kubectl-mcp-server tools -d'
alias kmcp-call='kubectl-mcp-server call'

Static analysis

No suspicious patterns detected.