Security audit

Kubernetes GitOps

Security checks for vulnerabilities and agentic risk

Overview

The instructions confuse refreshing application status with deployment synchronization, creating a risk of unintended changes to live workloads.

Review before granting cluster write access. Have the refresh examples corrected and verify the installed MCP tool's behavior. Use read-only access for status checks, and explicitly approve the application, cluster, namespace, and pending changes before synchronization. Pruning can delete resources.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Synchronization workflows omit warnings about live-cluster changes and present a sync operation as an app refresh.

High

Category: Output Handling
Confidence: 98% confidence
Finding: Ordinary sync examples are appropriate for a GitOps management skill, and missing warnings alone would not establish a vulnerability. However, presenting the same mutating operation as both “Sync Application” and “Refresh App” creates a concrete path from a status-refresh request to unintended deployment, potentially affecting production workloads; this overlaps with SDI-4 rather than constituting a separate exploit.
Content: No source excerpt is available for this finding.

The documented refresh operation invokes application sync, which can change deployed resources rather than merely refresh application state.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The documentation presents an application sync as a refresh, potentially causing an agent handling a read-only status request to deploy changes instead. In this GitOps context, the production example enables automated pruning and self-healing, so an unintended sync could modify or delete live resources, subject to application configuration and tool permissions.
Content: No source excerpt is available for this finding.

The workflow labels a sync operation as a refresh without warning that it can change live resources.

Medium

Category: Output Handling
Confidence: 94% confidence
Finding: The force-sync workflow incorrectly labels its first sync call as a refresh and then instructs a second sync. Although this section already implies authorization to change resources, the misleading label hides the first call's actual effects and may cause redundant reconciliation or reinforce unsafe reuse of sync for refresh-only tasks.
Content: No source excerpt is available for this finding.

The Force Sync workflow triggers cluster changes without warning that reconciliation can modify or delete production resources.

Medium

Category: Output Handling
Confidence: 96% confidence
Finding: This workflow instructs the agent to reconcile both the Git source and the Kustomization, rather than merely listing available tools. The supplied Kustomization targets production manifests and enables pruning (lines 34–35), but the workflow does not warn that synchronization can apply changes and delete previously managed resources removed from Git.
Content: No source excerpt is available for this finding.

Standalone mentions of "sync" or "reconcile" can activate the skill outside GitOps contexts.

Medium

Category: Trigger Abuse
Confidence: 98% confidence
Finding: The activation list treats generic words such as "sync" and "reconcile" as sufficient triggers without requiring Kubernetes, Flux, or ArgoCD context. These words occur in unrelated requests, and no exclusion conditions constrain their use.
Content: No source excerpt is available for this finding.

The “Refresh App” example performs an application sync rather than a status refresh.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The “Refresh App” example calls gitops_app_sync, which can reconcile desired manifests into the live cluster rather than merely update application status. An agent following this example for a read-only refresh request could deploy pending changes without authorization; the operational GitOps context makes this a consequential instruction error.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.