K8s清单生成入门

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.3

Overview

This is a Kubernetes YAML helper whose behavior is mostly disclosed and purpose-aligned, with documentation and dependency-safety caveats to review.

Install in an isolated environment, pin or review Python dependencies where possible, avoid putting real secrets into generated Secret manifests, and always inspect generated YAML and use dry-run validation before applying anything to a Kubernetes cluster.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:133

Finding

Unpinned Python Dependencies Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 133 and 245-246
Vulnerability Type: Unpinned third-party dependencies and missing integrity verification
Risk Level: Low

Vulnerable Code Snippet

bash

pip install pyyaml jsonschema

The dependency instructions later repeat installation without version or hash constraints:

bash

pip install pyyaml
pip install jsonschema

Technical Analysis

The skill instructs users or an execution-capable agent to install pyyaml and jsonschema without specifying exact versions, package hashes, or a trusted package index. Consequently, the resolved artifacts can change between installations even though the reviewed skill remains unchanged.

The package names appear legitimate and there is no evidence that the skill intentionally selects a malicious or misspelled package. Nevertheless, installation depends entirely on the current state of the configured Python package index. If an upstream release, package-maintainer account, package index, or local package-index configuration is compromised, pip may retrieve attacker-controlled installation content.

Python packages can execute build-system code during installation in relevant distribution scenarios. A malicious dependency can also execute later when imported by the manifest-generation or validation process. Because the skill allows the exec tool, an agent may follow these installation instructions directly rather than requiring a user to perform and review the installation.

Attack Path

1. A user or agent follows the environment-preparation instruction and runs pip install pyyaml jsonschema.
2. pip resolves the latest compatible versions from its configured package index because the skill provides no lock file or exact constraints.
3. An attacker must first compromise an upstream package, its publishing credentials, the selected package index, or the environment's index configuration.
4. The compromised artifact is down ...[truncated 1204 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed exact version:

bash

python3 -m pip install \
  "PyYAML==REVIEWED_VERSION" \
  "jsonschema==REVIEWED_VERSION"

2. Maintain dependencies in a lock or requirements file containing cryptographic hashes, and require hash verification:

bash

python3 -m pip install \
  --require-hashes \
  --only-binary=:all: \
  -r requirements.lock

3. Generate the lock file from reviewed artifacts and commit it with the skill so dependency changes are auditable.

4. Specify an approved HTTPS package index through controlled environment configuration. Do not silently fall back to untrusted extra indexes or mirrors.

5. Install dependencies inside an isolated virtual environment or container using a non-privileged account. Never recommend system-wide or root-level installation.

6. Scan and periodically update pinned dependencies through a controlled review process. Validate signatures or provenance attestations where the package ecosystem and selected repository support them.

7. If agents may execute setup commands automatically, require explicit user approval before dependency installation and display the package versions, source index, and expected hashes before execution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

./manifests/deployment.yaml

./manifests/service.yaml

./manifests/configmap.yaml

./manifests/secret.yaml

./manifests/pvc.yaml

text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation description is broad enough to match generic coding, debugging, testing, and deployment requests, which increases the chance the skill is invoked outside its narrowly intended Kubernetes-manifest context. Over-broad triggering is dangerous because the skill has exec permissions and may steer an agent into command execution or file handling in situations where a safer, more specific tool should have been used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states support for Chinese interaction in a way that can bias or force language selection without explicit user preference. While not a classic exploit, this can cause instruction mismatches, misunderstandings of security-sensitive output, or unintended routing/behavior in multilingual agent environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims the free edition is purely local and requires no API key, but elsewhere advertises API integration and HTTPS network communication as core capabilities. This inconsistency can mislead operators about the trust boundary and data flow, causing them to provide sensitive manifests or secrets under the assumption that no network egress occurs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L228 says the free version does not support custom templates, yet L160-L190 provides a YAML template configuration structure with named templates and defaults, implying user-editable template customization. This creates an intent/documentation contradiction about whether template definitions are fixed or configurable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.