Security audit

K8s清单生成专业版

Security checks for vulnerabilities and agentic risk

Overview

This Kubernetes DevOps skill is mostly aligned with its stated purpose, but it asks for command/write authority while using overly broad triggers and under-warning about live infrastructure changes.

Review before installing. Use this only for Kubernetes manifest, Helm, Kustomize, policy, GitOps, or CRD work; do not let the broad analytics/reporting wording trigger it for unrelated tasks. Require explicit target cluster, environment, repository, and dry-run or confirmation before running publish, sync, prune, install, or production commands. Do not store tokens in plaintext local config files unless you have verified permissions and storage protections.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest description blends unrelated data-analysis/reporting use cases into a Kubernetes DevOps skill, which can cause the agent to invoke this skill in the wrong context. Because the skill exposes exec/write capabilities and describes infrastructure-changing operations, mismatched routing could lead to unintended command execution or configuration changes during tasks that were not meant to touch Kubernetes resources.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file first recommends environment variables for secrets, then states that all credentials are stored in a local configuration file, creating contradictory secret-handling guidance. This inconsistency can lead implementers to persist tokens such as HELM_PASS, ARGOCD_TOKEN, or GIT_TOKEN on disk, increasing the risk of credential disclosure through source control, backups, shared workstations, or weak file permissions.

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill description contains broad, mismatched trigger language spanning analytics, reporting, visualization, independent developer workflows, and enterprise automation, far beyond the stated Kubernetes purpose. Over-broad activation increases the chance that an agent selects a skill with exec/write privileges for unrelated requests, which materially raises the risk of unintended file modification, command execution, or infrastructure-affecting operations.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The coverage statement enumerates an excessively broad keyword list, including generic and unrelated phrases, as a basis for skill activation. In an agentic environment this acts like a catch-all matcher, making accidental invocation more likely and reducing the operator's ability to predict when exec-capable functionality will be used.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The GitOps example enables auto_sync and auto_prune, behaviors that can automatically apply and delete cluster resources, but the documentation does not prominently warn that these settings can cause immediate external state changes. In the context of a skill with exec capability and cluster-management workflows, omission of such warnings increases the chance of destructive or surprising deployments, especially in production.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation includes commands to publish Helm charts and install CRDs without clearly warning that they affect external repositories and Kubernetes cluster state. Users or agents may treat these as routine local generation steps, when in fact they can create persistent changes, introduce new APIs, or disrupt existing workloads if run against real systems.

Static analysis

No suspicious patterns detected.