ClawHub
Back to skill

Security audit

Kubernetes Policy Management

Security checks for vulnerabilities and agentic risk

Overview

This Kubernetes management skill needs review because its examples can enforce rules across a cluster without clear scope selection or rollout safeguards.

Before allowing cluster changes, select the intended cluster and namespaces, start with Kyverno Audit or Gatekeeper dryrun, and review violations. Approve enforcement separately and prepare a rollback procedure. Pin and inspect controller installation manifests before applying them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Cluster-wide enforcement examples omit a warning that they can block workload creation and updates.

High
Category
Output Handling
Confidence
93% confidence
Finding

The examples apply enforcing ClusterPolicies matching Pods without namespace exclusions or a nearby explanation of their operational consequences. In this cluster-management skill, copying those examples can block noncompliant workload creation and relevant updates, including replacement Pods during rollouts or recovery; this overlaps with the audit-first finding rather than representing an independent exploit.

Content

No source excerpt is available for this finding.

Activation keywords include generic terms without requiring Kubernetes context.

Medium
Category
Trigger Abuse
Confidence
97% confidence
Finding

The skill explicitly activates on mentions of "policy", "compliance", "validate", or "enforce", which commonly occur outside Kubernetes policy management. Although the description identifies the domain, these activation conditions do not require that context or exclude unrelated requests.

Content

No source excerpt is available for this finding.

Kyverno examples apply enforcing policies directly despite the documented audit-first requirement.

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The executable examples set validationFailureAction to Enforce, contradicting the skill's explicit audit-first rule. If applied with sufficient cluster permissions, these policies can immediately reject noncompliant Pod admissions across namespaces, disrupting deployments and replacement workloads; existing running Pods are not automatically terminated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.