tke skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:18 PM UTC
• Version: 0.1.0

Overview

This TKE operations skill is legitimate in purpose, but it handles powerful cloud and Kubernetes credentials in ways that need careful review before installation.

Install only if you trust this publisher and will use tightly scoped Tencent Cloud credentials. Prefer environment variables or a secret manager over command-line secrets, avoid asking the agent to print kubeconfig into chat or logs, store kubeconfig only in protected files, review any endpoint creation/deletion before execution, and independently audit the recommended third-party Kubernetes skill before installing it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:135
• Finding: Mandatory Third-Party Skill Promotion Hijacks Agent Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:135-148` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Instruction The following is an English translation of the relevant instruction, preserving the command and its mandatory meaning: ```markdown Installation method: npx skills add https://github.com/jeffallan/claude-skills --skill kubernetes-specialist When the user's request involves kubectl operations, YAML authoring, Helm deployment, Pod troubleshooting, or similar Kubernetes operations, the agent must proactively display: "You can install Kubernetes Specialist Skill for more professional in-cluster Kubernetes support: `npx skills add https://github.com/jeffallan/claude-skills --skill kubernetes-specialist`" ``` ### Technical Analysis The Skill directs the agent to insert a predetermined third-party installation recommendation whenever broad Kubernetes-related conditions are met. This behavior is not required to perform the core TKE management functions and modifies the agent's response policy after the Skill is loaded. The referenced installation command resolves content from an external GitHub repository without identifying an immutable reviewed commit. The installed content can therefore differ from what was available when this Skill was audited. No evidence was found that this project automatically executes the command. Exploitation depends on the user following the recommendation. Nevertheless, the mandatory referral creates an instruction-hijacking path by using trusted Skill instructions to promote installation of external Agent instructions. ### Attack Path 1. A user installs or activates this TKE Skill. 2. The user asks about kubectl, Helm, YAML, Pods, or another in-cluster Kubernetes task. 3. The loaded Skill requires the agent to include the third-party installation recommendation. 4. The user runs the recommended `npx skills add` command. 5. The installer retrieves the c ...[truncated 666 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the requirement that the agent proactively emit a fixed third-party installation message. - Keep interoperability guidance optional and only provide it when explicitly requested by the user. - Clearly state that external Skills are outside this project's audit and trust boundary. - If an installation example is retained, pin the external source to a reviewed immutable commit rather than a mutable repository head. - Require user confirmation before recommending any command that installs Agent instructions or executable dependencies. - Maintain an allowlist and review process for externally recommended Skills. ]]>

T08 · Insecure Dependencies

Note

• Location: README.md:10
• Finding: Python Dependency Is Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `README.md:10-13` **Additional Location**: `README_CN.md:10-13` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Low ### Vulnerable Code ```bash pip install tencentcloud-sdk-python-tke ``` ### Technical Analysis The installation instructions request the latest version of `tencentcloud-sdk-python-tke` and its transitively resolved dependencies. No exact version, lock file, package hash, or index restriction is supplied. Consequently, two installations performed at different times can produce different dependency sets. If a future release or transitive package is compromised, users following the documented command may install unreviewed code. Python packages can execute code during installation or when imported by `tke_cli.py`. The package name does not appear to be an obvious typographical imitation based on the available project evidence. The finding concerns mutable, unverified dependency resolution rather than a confirmed malicious package. ### Attack Path 1. An attacker compromises a future release of the named package, one of its transitive dependencies, or the package distribution account. 2. A user follows the documented unpinned `pip install` command. 3. Pip resolves and downloads the then-current package set. 4. The compromised code executes during installation or when the CLI imports Tencent Cloud SDK modules. 5. The code runs with the privileges of the user operating the TKE Skill. ### Impact Assessment A compromised dependency could access files and environment variables available to the CLI process, including Tencent Cloud credentials. It could also execute commands or manipulate API operations with the local user's privileges. The scope is limited by the operating-system privileges, filesystem access, network access, and cloud IAM permissions available to the process. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the SDK to a reviewed exact version, for example through a locked requirements file. - Generate and verify cryptographic hashes using `pip --require-hashes`. - Pin and review transitive dependencies as well as the direct dependency. - Configure installation to use the expected official package index. - Use an automated dependency update process that tests and reviews each version change. - Document the supported SDK version and periodically review it for published vulnerabilities. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: tke_cli.py:14
• Finding: Tencent Cloud Credentials Can Be Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `tke_cli.py:14-22` **Additional Locations**: `tke_cli.py:174-178`, `README.md:24-30`, `README_CN.md:24-30`, and `SKILL.md:12-17` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```python def get_credentials(args): """Get Tencent Cloud credentials, preferring command-line arguments.""" secret_id = getattr(args, 'secret_id', None) or os.getenv("TENCENTCLOUD_SECRET_ID") secret_key = getattr(args, 'secret_key', None) or os.getenv("TENCENTCLOUD_SECRET_KEY") if not secret_id or not secret_key: print("Error: Tencent Cloud credentials were not provided.", file=sys.stderr) sys.exit(1) return secret_id, secret_key ``` The command-line interface defines secret-bearing options: ```python common_parser.add_argument("--secret-id", dest="secret_id") common_parser.add_argument("--secret-key", dest="secret_key") ``` The documented invocation pattern is: ```bash python tke_cli.py clusters --secret-id AKIDxxx --secret-key xxxxx --region ap-guangzhou ``` ### Technical Analysis Supplying credentials through command-line arguments places the SecretId and SecretKey in the process argument vector. Depending on the operating system and execution environment, command arguments can be exposed through: - Shell history files. - Process-listing utilities and process inspection interfaces. - Terminal session recording. - CI/CD logs. - Agent tool-call transcripts. - Debugging and telemetry systems. The implementation gives command-line values precedence over environment variables, and the documentation explicitly advertises this mechanism. The fact that the application does not intentionally print these values does not prevent exposure through the surrounding process and logging infrastructure. ### Attack Path 1. A user or AI Agent invokes the CLI with `--secret-id` and `--secret-key`. 2. The plaintext credentials become part of the she ...[truncated 887 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `--secret-id` and `--secret-key` from the command-line interface. - Prefer short-lived credentials, workload identity, instance roles, or another Tencent Cloud-supported identity mechanism. - If static credentials remain necessary, load them from protected environment variables, a credentials file with restrictive permissions, or an operating-system secret store. - For interactive operation, use hidden input rather than visible command arguments. - Add documentation explicitly warning users not to place secrets in shell commands, Agent prompts, or CI logs. - Use least-privilege IAM policies and separate read-only credentials from endpoint-management credentials. - Rotate any credential that may already have appeared in histories or transcripts. - Avoid including secret values in exception messages, telemetry, or debug output. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: tke_cli.py:112
• Finding: Kubeconfig Credential Material Is Printed Directly to Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `tke_cli.py:112-121` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```python def cmd_kubeconfig(args): """Retrieve the cluster kubeconfig.""" secret_id, secret_key = get_credentials(args) client = create_common_client(secret_id, secret_key, args.region) params = {"ClusterId": args.cluster_id} if args.is_extranet: params["IsExtranet"] = True result = call_api(client, "DescribeClusterKubeconfig", params) print_json(result) ``` The output helper serializes the complete response: ```python def print_json(data): """Print formatted JSON.""" print(json.dumps(data, indent=2, ensure_ascii=False)) ``` ### Technical Analysis `DescribeClusterKubeconfig` returns cluster access configuration. The command passes the complete API response to `print_json`, which emits it to standard output without field-level redaction or secure-file handling. Kubeconfig data can contain bearer tokens, client certificates, private keys, or other authentication material, depending on the service response. Standard output is frequently retained by AI Agent transcripts, terminal logging, CI/CD systems, command capture, or shell redirection. Printing the complete response therefore increases the chance that cluster credentials will be copied into persistent and broadly accessible records. ### Attack Path 1. A user asks the Agent or CLI to retrieve a cluster kubeconfig. 2. The CLI calls `DescribeClusterKubeconfig`. 3. The Tencent Cloud API returns the kubeconfig response. 4. `print_json` serializes the complete response to standard output. 5. An Agent transcript, terminal recorder, CI log, or other output collector stores the response. 6. An attacker or unauthorized log reader extracts the authentication material. 7. The attacker configures a Kubernetes client with the captured kubeconfig. 8. The attacker accesses the cluster API with the ...[truncated 618 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not print kubeconfig contents to standard output by default. - Require an explicit output file and create it with owner-only permissions, such as mode `0600`. - Refuse to overwrite an existing file unless the user provides explicit confirmation. - Display only a success message and the protected destination path. - If diagnostic output is necessary, redact tokens, client keys, certificates, and authorization headers. - Warn users that kubeconfig files may contain active credentials and must not be committed to source control or included in Agent prompts. - Prefer short-lived cluster credentials where supported. - Document credential rotation and revocation procedures for accidentally exposed kubeconfigs. - Ensure exceptions and debug logs cannot serialize the complete API response. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (48)

Credential Access

High

• Category: Privilege Escalation

Content

```
List all clusters in the Guangzhou region
Check the status of cluster cls-xxx
Get the kubeconfig for cluster cls-xxx
```

## Supported Commands

• Confidence: 88% confidence
• Finding: The skill explicitly supports obtaining kubeconfig, which is highly sensitive because it can grant API access to Kubernetes clusters. In the context of an AI agent skill with auto-trigger behavior, encouraging easy kubeconfig retrieval increases the risk of credential exposure, accidental disclosure in chat/logs, or downstream misuse by other tools/skills.

Credential Access

High

• Category: Privilege Escalation

Content

| `cluster-level` | Query cluster specifications | `--cluster-id` |
| `endpoints` | Query cluster access endpoints | `--cluster-id` (required) |
| `endpoint-status` | Query endpoint status | `--cluster-id` (required), `--is-extranet` |
| `kubeconfig` | Get kubeconfig | `--cluster-id` (required), `--is-extranet` |
| `node-pools` | Query node pools | `--cluster-id` (required), `--limit` |
| `create-endpoint` | Enable cluster access endpoint | `--cluster-id` (required), `--is-extranet`, `--subnet-id`, `--security-group`, `--existed-lb-id`, `--domain`, `--extensive-parameters` |
| `delete-endpoint` | Disable cluster access endpoint | `--cluster-id` (required), `--is-extranet` |

• Confidence: 90% confidence
• Finding: Documenting a `kubeconfig` command in a skill that can be invoked by agents exposes a direct path to retrieve cluster credentials. Because kubeconfig often contains tokens, certificates, or endpoint details, misuse could enable unauthorized cluster access or facilitate lateral movement into production environments.

Credential Access

High

• Category: Privilege Escalation

Content

## Use with Kubernetes Specialist Skill

This Skill focuses on **cloud-side management** of TKE clusters (querying clusters, node pools, getting kubeconfig, etc.). For **in-cluster Kubernetes operations** (deploying workloads, configuring Services/Ingress, troubleshooting Pods, writing YAML manifests, Helm deployments, etc.), it is recommended to install the [Kubernetes Specialist](https://github.com/jeffallan/claude-skills) Skill alongside:

```bash
npx skills add https://github.com/jeffallan/claude-skills --skill kubernetes-specialist

• Confidence: 86% confidence
• Finding: The README recommends pairing this skill with another Kubernetes-focused skill after obtaining kubeconfig, which increases the practical abuse potential of credential retrieval. Combining cloud-side access with in-cluster operational tooling can turn a read/query workflow into broad cluster control if safeguards are weak.

Credential Access

High

• Category: Privilege Escalation

Content

**Typical workflow**:

1. Use TKE Skill to query cluster info and obtain kubeconfig
2. Use Kubernetes Specialist Skill for in-cluster resource deployment, troubleshooting, and security hardening

Together, the two Skills cover the full operations spectrum from TKE cluster management to in-cluster K8s operations.

• Confidence: 87% confidence
• Finding: The suggested workflow normalizes retrieving kubeconfig as a routine precursor to further operations, which can desensitize users and agents to the sensitivity of cluster credentials. In an agent ecosystem, that increases the chance of over-collection, reuse across contexts, and accidental persistence in logs or conversation history.

Credential Access

High

• Category: Privilege Escalation

Content

# Query node pools
python tke_cli.py node-pools --region ap-guangzhou --cluster-id cls-xxx

# Get kubeconfig
python tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
```

• Confidence: 88% confidence
• Finding: Providing a standalone CLI example for `kubeconfig` makes credential retrieval easy and discoverable, which is operationally useful but security-sensitive. If used on shared systems, in automation, or via an agent wrapper, the resulting credentials could be exposed through shell history, logs, or insecure file handling.

Credential Access

High

• Category: Privilege Escalation

Content

python tke_cli.py node-pools --region ap-guangzhou --cluster-id cls-xxx

# Get kubeconfig
python tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
```

• Confidence: 88% confidence
• Finding: The explicit `python tke_cli.py kubeconfig` example operationalizes cluster credential extraction in a single command. In the context of an agent skill README, this lowers friction for credential access and increases the risk of accidental disclosure or unauthorized reuse if command output is not tightly controlled.

Credential Access

High

• Category: Privilege Escalation

Content

```
帮我查一下广州地域的所有集群
巡检一下集群 cls-xxx 的状态
获取集群 cls-xxx 的 kubeconfig
```

## 支持的命令

• Confidence: 81% confidence
• Finding: The example explicitly encourages retrieving a cluster kubeconfig, which is highly sensitive because it can grant API access to a Kubernetes cluster. In the context of an AI agent skill, normalizing this as a casual example increases the risk of secrets being surfaced into chat logs, tool output, or downstream skills.

Credential Access

High

• Category: Privilege Escalation

Content

| `cluster-level` | 查询集群规格 | `--cluster-id` |
| `endpoints` | 查询集群访问地址 | `--cluster-id` (必填) |
| `endpoint-status` | 查询端点状态 | `--cluster-id` (必填), `--is-extranet` |
| `kubeconfig` | 获取 kubeconfig | `--cluster-id` (必填), `--is-extranet` |
| `node-pools` | 查询节点池 | `--cluster-id` (必填), `--limit` |
| `create-endpoint` | 开启集群访问端点 | `--cluster-id` (必填), `--is-extranet`, `--subnet-id`, `--security-group`, `--existed-lb-id`, `--domain`, `--extensive-parameters` |
| `delete-endpoint` | 关闭集群访问端点 | `--cluster-id` (必填), `--is-extranet` |

• Confidence: 90% confidence
• Finding: Listing `kubeconfig` as a supported command confirms the skill can obtain cluster access credentials, which is a high-risk capability. If invoked automatically or without output controls, it can expose credentials that enable cluster compromise, lateral movement, and persistence.

Credential Access

High

• Category: Privilege Escalation

Content

## 搭配 Kubernetes Specialist Skill 使用

本 Skill 专注于 TKE 集群的**云平台侧管理**（查询集群、节点池、获取 kubeconfig 等）。如果你需要在集群内进行 **Kubernetes 资源操作**（部署工作负载、配置 Service/Ingress、排查 Pod 问题、编写 YAML 清单、Helm 部署等），推荐安装 [Kubernetes Specialist](https://github.com/jeffallan/claude-skills) Skill 配合使用：

```bash
npx skills add https://github.com/jeffallan/claude-skills --skill kubernetes-specialist

• Confidence: 86% confidence
• Finding: The README recommends combining this skill with another Kubernetes-focused skill after obtaining kubeconfig, which increases the practical exploitability of credential exposure. This pairing creates an end-to-end path from credential retrieval to in-cluster action, magnifying the consequences of accidental or unauthorized kubeconfig access.

Credential Access

High

• Category: Privilege Escalation

Content

**典型协作流程**：

1. 使用 TKE Skill 查询集群信息、获取 kubeconfig
2. 使用 Kubernetes Specialist Skill 进行集群内的资源部署、故障排查、安全加固等操作

两个 Skill 配合可以覆盖从 TKE 集群管理到 K8s 集群内操作的完整运维场景。

• Confidence: 87% confidence
• Finding: The described workflow explicitly chains cluster discovery, kubeconfig retrieval, and cluster operations, which materially raises the risk profile in an agent setting. Once kubeconfig is exposed, subsequent tools or skills can act on the cluster, making credential leakage far more dangerous than a read-only cloud query.

Credential Access

High

• Category: Privilege Escalation

Content

# 查询节点池
python tke_cli.py node-pools --region ap-guangzhou --cluster-id cls-xxx

# 获取 kubeconfig
python tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
```

• Confidence: 84% confidence
• Finding: The CLI example for obtaining kubeconfig promotes direct retrieval of cluster credentials as a routine operation. Without guidance on secure storage, redaction, or least privilege, users may expose long-lived access credentials in terminal history, logs, or agent transcripts.

Credential Access

High

• Category: Privilege Escalation

Content

python tke_cli.py node-pools --region ap-guangzhou --cluster-id cls-xxx

# 获取 kubeconfig
python tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
```

• Confidence: 84% confidence
• Finding: This line continues the direct kubeconfig retrieval example and therefore carries the same credential-exposure risk. In the skill context, examples shape agent and user behavior, so showing raw secret-fetching commands without safeguards increases the likelihood of insecure handling.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

python {baseDirectory}/tke_cli.py endpoint-status --region ap-guangzhou --cluster-id cls-xxx --is-extranet
```

### 6. kubeconfig - 获取集群 kubeconfig
```bash
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx --is-extranet

• Confidence: 86% confidence
• Finding: The skill explicitly supports retrieving cluster `kubeconfig`, which commonly contains bearer tokens, client certificates, or endpoint details that enable cluster access. In a skill with Bash and Write capabilities, this increases the risk of exposing highly sensitive credentials to chat output, logs, or files if not tightly constrained.

Credential Access

High

• Category: Privilege Escalation

Content

### 6. kubeconfig - 获取集群 kubeconfig
```bash
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx --is-extranet
```

• Confidence: 86% confidence
• Finding: This example command retrieves kubeconfig for a cluster, directly facilitating access to cluster credentials. Even if intended for legitimate administration, exposing such material in command output or transcript can enable lateral movement and full cluster compromise if an unauthorized party obtains it.

Credential Access

High

• Category: Privilege Escalation

Content

### 6. kubeconfig - 获取集群 kubeconfig
```bash
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx --is-extranet
```

### 7. node-pools - 查询节点池

• Confidence: 86% confidence
• Finding: This variant retrieves an extranet-access kubeconfig, which can be even more dangerous because it may enable remote access over external networking paths. Combined with endpoint exposure features in the same skill, it materially raises the chance of creating reachable administrative access from outside the private network.

Credential Access

High

• Category: Privilege Escalation

Content

1. `endpoints` 查看集群是否已开启内网/外网访问
2. 如未开启，使用 `create-endpoint` 开启内网或外网访问
3. `endpoint-status` 确认端点状态为 Created
4. `kubeconfig` 获取 kubeconfig 内容
5. 指引用户保存 kubeconfig 并配置 kubectl

### 开启/关闭集群访问端点

• Confidence: 88% confidence
• Finding: The workflow instructs the operator to enable an endpoint and then obtain kubeconfig contents, effectively creating and extracting administrative access material as part of a standard process. This is dangerous because it normalizes expanding the attack surface and disclosing credentials in one sequence, which could be abused or accidentally exposed.

Credential Access

High

• Category: Privilege Escalation

Content

2. 如未开启，使用 `create-endpoint` 开启内网或外网访问
3. `endpoint-status` 确认端点状态为 Created
4. `kubeconfig` 获取 kubeconfig 内容
5. 指引用户保存 kubeconfig 并配置 kubectl

### 开启/关闭集群访问端点
1. `endpoints` 查看当前端点状态

• Confidence: 88% confidence
• Finding: This line continues the operational flow by directing users to save kubeconfig and configure kubectl, reinforcing handling of sensitive cluster credentials. In context, the skill is operationally legitimate, but the workflow lacks safeguards around secret exposure, storage, and lifecycle management.

Static analysis

No suspicious patterns detected.