ClawHub
Back to skill

Security audit

Kubernetes Cost Optimization

Security checks for vulnerabilities and agentic risk

Overview

This Kubernetes cost-saving skill needs review because it directs storage deletion and workload changes without clear approval or recovery checks.

Start with read-only cluster permissions and explicitly select the cluster and namespaces. Require approval for each deletion, sizing change, or scaling action. Before deleting storage, verify ownership, future consumers, retention requirements, reclaim policy, and recoverable backups. Validate workload demand and rollback steps before resizing or scaling.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

The workflow instructs deletion of unused PVCs without warning about potential persistent-data loss.

High
Category
Output Handling
Confidence
99% confidence
Finding

The skill explicitly recommends deleting PVCs after idle-resource detection and also ranks this action as its highest priority, without a data-retention check or confirmation gate. An unattached PVC may still hold valuable application or recovery data, and deletion can destroy the underlying storage when the persistent volume's reclaim policy is Delete.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/find-overprovisioned.py (reported line 22)May include surrounding context.

python
Args:
        namespace: Optional namespace filter
        context: Optional kubeconfig context

    Returns:
        Dictionary with findings and recommendations

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Activation keywords overlap with everyday requests and are not constrained to Kubernetes.

Medium
Category
Trigger Abuse
Confidence
99% confidence
Finding

The activation rules include generic words such as 'cost', 'budget', and 'reduce' without requiring Kubernetes context. Although the title and description provide contextual cues, literal keyword-based activation could route unrelated requests into a cluster workflow that prioritizes deletion and scaling without explicit authorization.

Content

No source excerpt is available for this finding.

Pod right-sizing and off-hours scaling are instructed without warning about workload disruption.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The skill directs the agent to apply sizing recommendations and scale down development or staging workloads without requiring approval, workload validation, or rollback planning. Its simple utilization thresholds do not establish peak demand or service requirements, so following these instructions can cause scheduling problems, workload restarts, memory pressure, or interruption of shared non-production services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.