Security audit
Security checks for vulnerabilities and agentic risk
This Kubernetes advice skill is not clearly malicious, but it requests broad write and execution access while presenting itself as a simple Markdown troubleshooting guide.
Review before installing. Use this only if you are comfortable with an agent having shell execution and file-write authority in an environment where kubectl may be configured. Prefer a read-only/advisory version, require explicit confirmation before any kubectl command, and avoid using it against production clusters without tight namespace and context controls.
The activation language is overly broad, covering generic coding, debugging, testing, deployment, and automation scenarios rather than narrowly scoped Kubernetes troubleshooting. Broad trigger conditions increase the chance that an agent routes unrelated requests into a skill that has exec/write privileges, leading to unnecessary exposure and possible unsafe command generation or execution.
The skill is presented as a read-oriented Kubernetes troubleshooting knowledge base, yet it declares both write and exec capabilities. This creates a dangerous privilege mismatch: an agent invoking the skill for advice could also modify files or execute shell commands against the local environment or a connected cluster, enabling unintended state changes far beyond the documented purpose.
Write access is not justified by the described functionality, which focuses on guidance, diagnosis, and manual troubleshooting. Unnecessary write capability expands the attack surface by allowing prompt-influenced modification of workspace files, configs, or generated manifests without clear user expectation.
The capability scope is defined through a broad keyword list instead of strict behavioral boundaries. Keyword-triggered activation is easy to overmatch, especially in agentic environments, which can cause the skill to be invoked for requests outside its safe domain while still retaining operational tooling.
The skill includes troubleshooting steps and automated retry language involving network connectivity tests without clearly warning that these steps may interact with live systems or enterprise network controls. In a real environment, such actions can violate change-control expectations, produce misleading diagnostics, or trigger outbound activity the user did not intend.
The example includes interactive kubectl exec, which can provide shell access inside a running container, yet no warning or restriction is provided. In the context of a skill with exec capability, this is especially dangerous because it normalizes direct interactive access to production workloads and could facilitate data exposure, tampering, or privilege abuse.
The documentation says the free version is a pure Markdown knowledge base and does not require cluster connectivity, but earlier sections include operational commands and troubleshooting flows that imply live environment interaction. This inconsistency can mislead users and downstream agents into treating the skill as harmless documentation while it can trigger or encourage actions against real infrastructure.
The skill name and most content are in Chinese, while the manifest description injects English phrases like 'Use when' into the primary instructions. This establishes a mixed-language experience without documenting language preference, opt-in, or locale choice for users.
The FAQ explicitly says the free version only provides troubleshooting advice and that fixes must be executed manually. In contrast, the '核心功能执行' section says it supports '创建/查询/导出操作', which suggests a broader active capability than advisory-only manual guidance.
No suspicious patterns detected.
