T01 · Skill Instruction Hijacking
Note
- Location
SKILL.md:241- Finding
Mandatory Promotional Content Hijacks Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
kube-medic
Security checks for vulnerabilities and agentic risk
Overview
This Kubernetes triage skill is mostly transparent, but its optional write-command path can make broader cluster changes than the documentation promises.
Install only if you are comfortable giving the agent kubectl visibility into your cluster and logs. Use a read-only, namespace-scoped kubeconfig where possible, avoid enabling write RBAC for production, and do not approve --confirm-write commands unless you have checked the exact context, namespace, target, and flags.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/kube-medic.sh:599- Finding
Prefix-Only Write Allowlist Permits Cluster-Wide Destructive Operations
- Content
View full analysis
&1) || true ``` ### Technical Analysis The write-command validator checks only the first two or three command tokens. After this prefix check succeeds, every remaining argument is forwarded directly to `kubectl`. The validator does not require a single named target and does not reject bulk-operation flags such as: - `--all` - `--all-namespaces` or `-A` - Label selectors - Additional context or namespace flags - Other flags that expand the operation's scope Consequently, a command such as the following passes the allowlist because its first three tokens are `kubectl delete pod`: ```bash kubectl delete pod --all --all-namespaces ``` The command can delete every pod that the active Kubernetes identity is authorized to delete. This contradicts the d ...[truncated 2236 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
jq --version
text That's it. No API keys. No extra config. Uses your existing kubeconfig. ## Example Interaction
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
jq --version
text That's it. No API keys. No extra config. Uses your existing kubeconfig. ## Example Interaction
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
jq --version
text That's it. No API keys. No extra config. Uses your existing kubeconfig. ## Example Interaction
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
jq --version
text That's it. No API keys. No extra config. Uses your existing kubeconfig. ## Example Interaction
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh jq --version ``` That's it. No API keys. No extra config. Uses your existing kubeconfig. ## Example Interaction
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 4. **No `kubectl exec`. Ever.** `kubectl exec` is not in the allowlist and cannot be executed through kube-medic. This prevents arbitrary command execution inside containers, which is the highest-risk kubectl operation. 5. **No credential leakage.** kube-medic never includes the following in its output: - Kubeconfig file paths or contents - Service account tokens - Secret values (kube-medic never reads Kubernetes Secrets) - Cloud provider credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 4. **No `kubectl exec`. Ever.** `kubectl exec` is not in the allowlist and cannot be executed through kube-medic. This prevents arbitrary command execution inside containers, which is the highest-risk kubectl operation. 5. **No credential leakage.** kube-medic never includes the following in its output: - Kubeconfig file paths or contents - Service account tokens - Secret values (kube-medic never reads Kubernetes Secrets) - Cloud provider credentials
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents the skill primarily as diagnostics and triage, but the documented behavior includes mutating cluster operations such as rollback, restart, scale, pod deletion, and node cordon/uncordon. That mismatch is dangerous because users, reviewers, or calling agents may treat it as read-only while it can materially change production state.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is presented as a triage/diagnostics utility, but it includes a built-in path to execute mutating kubectl operations via --confirm-write. In a diagnostic skill context, adding write capability expands the trust boundary and can enable rollback, scaling, deletion, or node scheduling changes that may disrupt workloads or mask incidents.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script directly executes cluster-modifying kubectl commands from user-supplied input, limited only by a simple allowlist and character filter. Even with some restrictions, this gives a diagnostics-oriented skill the ability to delete pods, scale workloads, restart rollouts, and cordon nodes, which can be abused for denial of service, incident interference, or unauthorized operational changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README advertises very broad natural-language triggers such as 'What's wrong with my cluster?' and similar support-style prompts. In an agent ecosystem, generic trigger phrasing can cause accidental invocation in unrelated conversations about production incidents, resulting in unintended access to cluster diagnostics and disclosure of operational state to the skill.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Threat | Mitigation | |--------|------------| | Agent executes destructive commands without approval | Write allowlist + user confirmation gate | | Arbitrary command execution via `kubectl exec` | `exec` is not in the allowlist; blocked unconditionally | | Credential leakage in output | No secrets, tokens, or kubeconfig in JSON output | | Shell injection via pod/deployment names | All values passed through `jq --arg`; shell variables quoted |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill exposes powerful cluster-facing capabilities through kubectl but does not declare any explicit tool scope, permissions model, or allowed-tools boundary. In practice, this makes the trust boundary unclear and increases the chance that an agent can invoke broader cluster/network actions than a reviewer or user would expect.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The testing instructions tell users to patch metrics-server with --kubelet-insecure-tls, which disables verification of the kubelet's TLS certificate. Even though it is labeled 'test only', the command applies to whatever cluster context kubectl is currently targeting, so a user could weaken transport security on a non-disposable or mis-targeted cluster. In a Kubernetes diagnostics skill, this is more dangerous because users are explicitly encouraged to run operational commands against real clusters.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The header frames the tool as read-only by default, while the documented global flag exposes a general write-execution feature. This mismatch can mislead users or reviewers into granting the skill broader trust and access than a tool with embedded mutation capability deserves, increasing the chance of unsafe deployment in sensitive clusters.
- Content
Static analysis
No suspicious patterns detected.