Kubernetes Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

This Kubernetes management skill is not clearly malicious, but it asks for powerful cluster access and mutation authority without enough safeguards.

Install only if you are comfortable granting an agent Kubernetes access. Use a dedicated low-privilege kubeconfig, restrict RBAC and namespaces, avoid production contexts by default, require explicit confirmation or dry-run review for writes/deletes, and do not pass real secret values directly on the command line.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:152

Finding

Unpinned Runtime Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:152 and SKILL.md:264-265
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Install Python dependencies
pip install kubernetes

markdown

| kubernetes | Python library | Required | `pip install kubernetes` |
| PyYAML | Python library | Required | `pip install pyyaml` |

Technical Analysis

The skill instructs users or agents to install kubernetes and PyYAML without fixed versions, package hashes, a lockfile, or an explicitly trusted package repository. Consequently, the installed artifacts can change between executions even when the reviewed skill remains unchanged.

Package installation and subsequent imports may execute package-controlled code in the context of the invoking user. This is especially sensitive because the skill is intended to access Kubernetes credentials through ~/.kube/config and manage cluster resources.

There is no evidence that either named package is currently malicious. The vulnerability is the mutable and insufficiently verified dependency resolution process.

Attack Path

1. An attacker compromises a dependency release, its distribution account, or the package source used by the environment.
2. A user or agent follows the documented installation command.
3. pip resolves and installs the attacker-controlled release because no reviewed version or hash is required.
4. Malicious code executes during installation or when the package is imported by the skill's runtime.
5. The code accesses resources available to the invoking process, potentially including Kubernetes credentials and the cluster API.

Impact Assessment

Successful exploitation could provide code execution with the operating-system privileges of the user running the agent. The attacker could read files accessible to that user, including kubeconfig data, and interact w ...[truncated 324 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed, exact version in a requirements file.
2. Require package hashes, for example through pip install --require-hashes -r requirements.txt.
3. Generate and retain a lockfile using a dependency-management tool that supports reproducible resolution.
4. Configure an approved package index rather than relying on ambient pip configuration.
5. Scan locked dependencies for known vulnerabilities and review updates before changing versions.
6. Install packages inside an isolated virtual environment or container.
7. Run dependency installation without access to kubeconfig credentials and expose those credentials only to the minimum runtime component that requires them.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:175

Finding

Kubernetes Secret Passed Through a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:175
Vulnerability Type: Sensitive information exposure through process arguments and command logging
Risk Level: Medium

Vulnerable Code Snippet:

bash

python3 （please refer to the script files in the skill directory） secret create --name my-secret --from-literal password=xxx

Technical Analysis

The documented command places secret material directly in a command-line argument. If a user replaces xxx with a real credential, the plaintext value can be captured by shell history, process inspection facilities, terminal recording, agent transcripts, audit systems, debugging output, or command telemetry.

Masking the resulting Kubernetes Secret does not protect the credential at these earlier exposure points. The project contains no implementation showing that the argument is removed from process metadata or redacted from logs.

Attack Path

1. A user follows the example and substitutes a real password for xxx.
2. The agent or shell executes the command with the password embedded in its argument vector.
3. The command is retained in shell history, an agent transcript, execution logs, or process-monitoring output.
4. A local user, administrator, logging-system operator, or party with access to retained transcripts retrieves the plaintext credential.
5. The attacker uses the credential against the application or service for which the Kubernetes Secret was created.

Impact Assessment

Exploitation does not inherently grant Kubernetes privileges; it discloses the secret supplied by the user. The resulting access depends on the credential's purpose and permissions. Exposure could lead to unauthorized application access, database compromise, service-account impersonation, or further lateral movement.

The disclosure scope includes every system that records or can inspect command arguments, including local shell history, process monitors, centraliz ...[truncated 42 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not accept secret values directly through command-line arguments.
2. Read secret material from standard input without echoing it, or from a protected file with restrictive permissions.
3. Prefer integrations with an approved secret manager and pass only a secret reference to the command.
4. Redact sensitive values from agent transcripts, diagnostic output, audit events, and error messages.
5. Disable shell tracing and command echoing around secret-handling operations.
6. Ensure temporary secret files, if unavoidable, are created with owner-only permissions and securely removed immediately after use.
7. Update the documentation to demonstrate a non-argument-based secret input workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Referencing ~/.kube/config indicates the skill is designed to use local Kubernetes credentials, which are sensitive and often grant broad cluster access. While mentioning the path alone is common documentation, in this skill it is paired with management and execution features that can act on those credentials, making accidental high-impact operations more plausible.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

yaml

k8s_config:
  kubeconfig: "~/.kube/config"
  context: "default"
  namespace: "default"
# ...

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Referencing ~/.kube/config indicates the skill is designed to use local Kubernetes credentials, which are sensitive and often grant broad cluster access. While mentioning the path alone is common documentation, in this skill it is paired with management and execution features that can act on those credentials, making accidental high-impact operations more plausible.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

yaml

k8s_config:
  kubeconfig: "~/.kube/config"
  context: "default"
  namespace: "default"
# ...

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md

### Q4：如何接入已有集群？

配置kubeconfig文件指向已有集群的API Server。本工具通过kubernetes-python客户端连接集群，无需在集群内部署。

## 依赖说明

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

md

### Q4：如何接入已有集群？

配置kubeconfig文件指向已有集群的API Server。本工具通过kubernetes-python客户端连接集群，无需在集群内部署。

## 依赖说明

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The documentation explicitly states that kubeconfig contains cluster access credentials yet does not pair that statement with any handling restrictions or safety requirements. In the context of an agent-enabled cluster management skill, this omission meaningfully raises the risk of over-privileged use, accidental disclosure, or unsafe automation against a live cluster.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md

### API Key 配置

- 通过kubeconfig认证集群
- 无需额外API Key
- kubeconfig文件包含集群访问凭证

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises create, update, and delete operations for Kubernetes resources but does not require confirmation, scope limitation, or explicit warnings before potentially destructive actions. In an agentic context with exec/write capabilities, this can lead to unintended deletion, service disruption, or production changes from ambiguous user prompts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

python3 （请参考skill目录中的脚本文件） rollout --deployment my-app --status
# ...
# 配置管理
python3 （请参考skill目录中的脚本文件） configmap create --name my-config --from-file ./config.yaml
python3 （请参考skill目录中的脚本文件） secret create --name my-secret --from-literal password=xxx
# ...
# 故障排查

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

python3 (请参考skill目录中的脚本文件) rollout --deployment my-app --status
# ...
# 配置管理
python3 (请参考skill目录中的脚本文件) configmap create --name my-config --from-file ./config.yaml
python3 (请参考skill目录中的脚本文件) secret create --name my-secret --from-literal password=xxx
# ...
# 故障排查

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to authenticate via kubeconfig and notes that the file contains cluster access credentials, but provides no safeguards for handling or limiting those credentials. This encourages use of highly sensitive cluster tokens/certificates in a tool that also exposes exec behavior, increasing the chance of credential misuse or over-privileged access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.