ClawHub
Back to skill

Security audit

tke skill

Security checks for vulnerabilities and agentic risk

Overview

This TKE operations skill is legitimate in purpose, but it handles powerful cloud and Kubernetes credentials in ways that need careful review before installation.

Install only if you trust this publisher and will use tightly scoped Tencent Cloud credentials. Prefer environment variables or a secret manager over command-line secrets, avoid asking the agent to print kubeconfig into chat or logs, store kubeconfig only in protected files, review any endpoint creation/deletion before execution, and independently audit the recommended third-party Kubernetes skill before installing it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:135
Finding

Mandatory Third-Party Skill Promotion Hijacks Agent Responses

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:10
Finding

Python Dependency Is Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
tke_cli.py:14
Finding

Tencent Cloud Credentials Can Be Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
tke_cli.py:112
Finding

Kubeconfig Credential Material Is Printed Directly to Standard Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (48)

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill explicitly supports obtaining kubeconfig, which is highly sensitive because it can grant API access to Kubernetes clusters. In the context of an AI agent skill with auto-trigger behavior, encouraging easy kubeconfig retrieval increases the risk of credential exposure, accidental disclosure in chat/logs, or downstream misuse by other tools/skills.

Content

Scanner excerpt · README.md (reported line 84)May include surrounding context.

text
List all clusters in the Guangzhou region
Check the status of cluster cls-xxx
Get the kubeconfig for cluster cls-xxx

Supported Commands

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Documenting a kubeconfig command in a skill that can be invoked by agents exposes a direct path to retrieve cluster credentials. Because kubeconfig often contains tokens, certificates, or endpoint details, misuse could enable unauthorized cluster access or facilitate lateral movement into production environments.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

md
| `cluster-level` | Query cluster specifications | `--cluster-id` |
| `endpoints` | Query cluster access endpoints | `--cluster-id` (required) |
| `endpoint-status` | Query endpoint status | `--cluster-id` (required), `--is-extranet` |
| `kubeconfig` | Get kubeconfig | `--cluster-id` (required), `--is-extranet` |
| `node-pools` | Query node pools | `--cluster-id` (required), `--limit` |
| `create-endpoint` | Enable cluster access endpoint | `--cluster-id` (required), `--is-extranet`, `--subnet-id`, `--security-group`, `--existed-lb-id`, `--domain`, `--extensive-parameters` |
| `delete-endpoint` | Disable cluster access endpoint | `--cluster-id` (required), `--is-extranet` |

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The README recommends pairing this skill with another Kubernetes-focused skill after obtaining kubeconfig, which increases the practical abuse potential of credential retrieval. Combining cloud-side access with in-cluster operational tooling can turn a read/query workflow into broad cluster control if safeguards are weak.

Content

Scanner excerpt · README.md (reported line 107)May include surrounding context.

Use with Kubernetes Specialist Skill

This Skill focuses on cloud-side management of TKE clusters (querying clusters, node pools, getting kubeconfig, etc.). For in-cluster Kubernetes operations (deploying workloads, configuring Services/Ingress, troubleshooting Pods, writing YAML manifests, Helm deployments, etc.), it is recommended to install the Kubernetes Specialist Skill alongside:

bash
npx skills add https://github.com/jeffallan/claude-skills --skill kubernetes-specialist

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The suggested workflow normalizes retrieving kubeconfig as a routine precursor to further operations, which can desensitize users and agents to the sensitivity of cluster credentials. In an agent ecosystem, that increases the chance of over-collection, reuse across contexts, and accidental persistence in logs or conversation history.

Content

Scanner excerpt · README.md (reported line 115)May include surrounding context.

md
**Typical workflow**:

1. Use TKE Skill to query cluster info and obtain kubeconfig
2. Use Kubernetes Specialist Skill for in-cluster resource deployment, troubleshooting, and security hardening

Together, the two Skills cover the full operations spectrum from TKE cluster management to in-cluster K8s operations.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

Providing a standalone CLI example for kubeconfig makes credential retrieval easy and discoverable, which is operationally useful but security-sensitive. If used on shared systems, in automation, or via an agent wrapper, the resulting credentials could be exposed through shell history, logs, or insecure file handling.

Content

Scanner excerpt · README.md (reported line 134)May include surrounding context.

Query node pools

python tke_cli.py node-pools --region ap-guangzhou --cluster-id cls-xxx

Get kubeconfig

python tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx

text

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The explicit python tke_cli.py kubeconfig example operationalizes cluster credential extraction in a single command. In the context of an agent skill README, this lowers friction for credential access and increases the risk of accidental disclosure or unauthorized reuse if command output is not tightly controlled.

Content

Scanner excerpt · README.md (reported line 135)May include surrounding context.

python tke_cli.py node-pools --region ap-guangzhou --cluster-id cls-xxx

Get kubeconfig

python tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx

text

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

The example explicitly encourages retrieving a cluster kubeconfig, which is highly sensitive because it can grant API access to a Kubernetes cluster. In the context of an AI agent skill, normalizing this as a casual example increases the risk of secrets being surfaced into chat logs, tool output, or downstream skills.

Content

Scanner excerpt · README_CN.md (reported line 84)May include surrounding context.

text
帮我查一下广州地域的所有集群
巡检一下集群 cls-xxx 的状态
获取集群 cls-xxx 的 kubeconfig

支持的命令

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Listing kubeconfig as a supported command confirms the skill can obtain cluster access credentials, which is a high-risk capability. If invoked automatically or without output controls, it can expose credentials that enable cluster compromise, lateral movement, and persistence.

Content

Scanner excerpt · README_CN.md (reported line 96)May include surrounding context.

md
| `cluster-level` | 查询集群规格 | `--cluster-id` |
| `endpoints` | 查询集群访问地址 | `--cluster-id` (必填) |
| `endpoint-status` | 查询端点状态 | `--cluster-id` (必填), `--is-extranet` |
| `kubeconfig` | 获取 kubeconfig | `--cluster-id` (必填), `--is-extranet` |
| `node-pools` | 查询节点池 | `--cluster-id` (必填), `--limit` |
| `create-endpoint` | 开启集群访问端点 | `--cluster-id` (必填), `--is-extranet`, `--subnet-id`, `--security-group`, `--existed-lb-id`, `--domain`, `--extensive-parameters` |
| `delete-endpoint` | 关闭集群访问端点 | `--cluster-id` (必填), `--is-extranet` |

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The README recommends combining this skill with another Kubernetes-focused skill after obtaining kubeconfig, which increases the practical exploitability of credential exposure. This pairing creates an end-to-end path from credential retrieval to in-cluster action, magnifying the consequences of accidental or unauthorized kubeconfig access.

Content

Scanner excerpt · README_CN.md (reported line 107)May include surrounding context.

搭配 Kubernetes Specialist Skill 使用

本 Skill 专注于 TKE 集群的云平台侧管理（查询集群、节点池、获取 kubeconfig 等）。如果你需要在集群内进行 Kubernetes 资源操作（部署工作负载、配置 Service/Ingress、排查 Pod 问题、编写 YAML 清单、Helm 部署等），推荐安装 Kubernetes Specialist Skill 配合使用：

bash
npx skills add https://github.com/jeffallan/claude-skills --skill kubernetes-specialist

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The described workflow explicitly chains cluster discovery, kubeconfig retrieval, and cluster operations, which materially raises the risk profile in an agent setting. Once kubeconfig is exposed, subsequent tools or skills can act on the cluster, making credential leakage far more dangerous than a read-only cloud query.

Content

Scanner excerpt · README_CN.md (reported line 115)May include surrounding context.

md
**典型协作流程**：

1. 使用 TKE Skill 查询集群信息、获取 kubeconfig
2. 使用 Kubernetes Specialist Skill 进行集群内的资源部署、故障排查、安全加固等操作

两个 Skill 配合可以覆盖从 TKE 集群管理到 K8s 集群内操作的完整运维场景。

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The CLI example for obtaining kubeconfig promotes direct retrieval of cluster credentials as a routine operation. Without guidance on secure storage, redaction, or least privilege, users may expose long-lived access credentials in terminal history, logs, or agent transcripts.

Content

Scanner excerpt · README_CN.md (reported line 134)May include surrounding context.

查询节点池

python tke_cli.py node-pools --region ap-guangzhou --cluster-id cls-xxx

获取 kubeconfig

python tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx

text

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

This line continues the direct kubeconfig retrieval example and therefore carries the same credential-exposure risk. In the skill context, examples shape agent and user behavior, so showing raw secret-fetching commands without safeguards increases the likelihood of insecure handling.

Content

Scanner excerpt · README_CN.md (reported line 135)May include surrounding context.

python tke_cli.py node-pools --region ap-guangzhou --cluster-id cls-xxx

获取 kubeconfig

python tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tke_cli.py (reported line 114)May include surrounding context.

python
---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tke_cli.py (reported line 188)May include surrounding context.

python
---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tke_cli.py (reported line 224)May include surrounding context.

python
---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tke_cli.py (reported line 225)May include surrounding context.

python
---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tke_cli.py (reported line 227)May include surrounding context.

python
---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tke_cli.py (reported line 228)May include surrounding context.

python
---
name: tke
description: 腾讯云 TKE 容器服务运维专家，支持集群巡检、状态查询、节点池管理、kubeconfig 获取等
allowed-tools: Read, Bash, Write
---

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The skill explicitly supports retrieving cluster kubeconfig, which commonly contains bearer tokens, client certificates, or endpoint details that enable cluster access. In a skill with Bash and Write capabilities, this increases the risk of exposing highly sensitive credentials to chat output, logs, or files if not tightly constrained.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

python {baseDirectory}/tke_cli.py endpoint-status --region ap-guangzhou --cluster-id cls-xxx --is-extranet

text

### 6. kubeconfig - 获取集群 kubeconfig
```bash
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx --is-extranet

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

This example command retrieves kubeconfig for a cluster, directly facilitating access to cluster credentials. Even if intended for legitimate administration, exposing such material in command output or transcript can enable lateral movement and full cluster compromise if an unauthorized party obtains it.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

6. kubeconfig - 获取集群 kubeconfig

bash
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx --is-extranet

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

This variant retrieves an extranet-access kubeconfig, which can be even more dangerous because it may enable remote access over external networking paths. Combined with endpoint exposure features in the same skill, it materially raises the chance of creating reachable administrative access from outside the private network.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

6. kubeconfig - 获取集群 kubeconfig

bash
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx
python {baseDirectory}/tke_cli.py kubeconfig --region ap-guangzhou --cluster-id cls-xxx --is-extranet

7. node-pools - 查询节点池

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The workflow instructs the operator to enable an endpoint and then obtain kubeconfig contents, effectively creating and extracting administrative access material as part of a standard process. This is dangerous because it normalizes expanding the attack surface and disclosing credentials in one sequence, which could be abused or accidentally exposed.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
1. `endpoints` 查看集群是否已开启内网/外网访问
2. 如未开启，使用 `create-endpoint` 开启内网或外网访问
3. `endpoint-status` 确认端点状态为 Created
4. `kubeconfig` 获取 kubeconfig 内容
5. 指引用户保存 kubeconfig 并配置 kubectl

### 开启/关闭集群访问端点

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

This line continues the operational flow by directing users to save kubeconfig and configure kubectl, reinforcing handling of sensitive cluster credentials. In context, the skill is operationally legitimate, but the workflow lacks safeguards around secret exposure, storage, and lifecycle management.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
2. 如未开启，使用 `create-endpoint` 开启内网或外网访问
3. `endpoint-status` 确认端点状态为 Created
4. `kubeconfig` 获取 kubeconfig 内容
5. 指引用户保存 kubeconfig 并配置 kubectl

### 开启/关闭集群访问端点
1. `endpoints` 查看当前端点状态

Static analysis

No suspicious patterns detected.