ClawHub
Back to skill

Security audit

Kubernetes Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

The skill is an openly described Kubernetes administration guide, but it can change or delete live cluster resources and handle secrets without enough safety guardrails.

Install only if you are comfortable giving the agent access to your Kubernetes context. Use a least-privilege kubeconfig, verify the active context and namespace before commands, avoid inline secrets, and require manual approval for delete, scale, rollout, and other mutating operations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill documents destructive cluster operations such as create, update, scale, and delete without an explicit warning, confirmation, or environment-safety guidance. In a Kubernetes administration context, ambiguous or automatic execution of these actions can lead to unintended changes to live workloads, outages, or loss of production resources.

Session Persistence

Medium
Category
Rogue Agent
Content
python3 （请参考skill目录中的脚本文件） rollout --deployment my-app --status
# ...
# 配置管理
python3 （请参考skill目录中的脚本文件） configmap create --name my-config --from-file ./config.yaml
python3 （请参考skill目录中的脚本文件） secret create --name my-secret --from-literal password=xxx
# ...
# 故障排查
Confidence
84% confidence
Finding
create --name my-config --from-file ./config.yaml python3 （请参考skill目录中的脚本文件） secret create --name my-secret --from-literal password=xxx # ... # 故障排查 python3 （请参考skill目录中的脚本文件） diagnose --pod my-app-xx

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.