Knative Serving

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:00 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent Knative guidance, but one install example asks users to run an unpinned container with their Kubernetes credentials mounted read-write.

Review the kn CLI install guidance before use. Prefer installing a pinned official kn release locally, or if using a container, use a verified digest or fixed version, mount kubeconfig read-only, and use a dedicated least-privileged kubeconfig rather than an administrative default context.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: references/kn-cli.md:35

Finding

Mutable Container Image Executes with Read-Write Access to Kubernetes Credentials

Content

View full analysis

Vulnerability Details

File Location: references/kn-cli.md:35
Vulnerability Type: Supply-chain risk from an unpinned executable dependency with access to sensitive credentials
Risk Level: High

Complete Vulnerable Code Snippet:

bash

docker run --rm -v "$HOME/.kube/config:/root/.kube/config" gcr.io/knative-releases/knative.dev/client/cmd/kn:latest service list

Technical Analysis

The documented command executes the Knative client container using the mutable latest tag. A mutable tag can resolve to different image contents over time without any corresponding change to the reviewed Skill. Consequently, the effective executable payload is not cryptographically pinned to the version that was originally assessed.

The container also receives a read-write mount of the user's Kubernetes configuration file. This file can contain cluster endpoints, bearer tokens, client certificates, authentication-provider configuration, or references to credential-exec plugins. Code running in the container can read these credentials and may overwrite the mounted kubeconfig.

Combining a mutable executable dependency with credential access creates a supply-chain exposure. This does not establish that the referenced official image is currently malicious; the risk arises if its registry account, publishing pipeline, mutable tag, or image contents are compromised or unexpectedly changed.

Attack Path

1. An attacker compromises the upstream image publishing pipeline, registry account, or mutable latest tag.
2. The attacker publishes a modified image under gcr.io/knative-releases/knative.dev/client/cmd/kn:latest.
3. A user follows the Skill documentation and runs the provided command.
4. Docker retrieves and executes the attacker-controlled image.
5. The image reads /root/.kube/config from the mounted host file.
6. The image extracts usable Kubernetes authentication material or uses it directly to contact the c ...[truncated 972 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an immutable, release-specific image digest that has been verified through the official Knative release process:

   bash

   docker run --rm \
     -v "$HOME/.kube/config:/root/.kube/config:ro" \
     gcr.io/knative-releases/knative.dev/client/cmd/kn@sha256:<verified-digest> \
     service list
   

2. Mount kubeconfig read-only by adding :ro, preventing the container from altering the host file.

3. Use a dedicated kubeconfig containing a least-privileged service account or user context rather than mounting the user's general administrative configuration.

4. Pin a documented Knative client release version and record its digest so upgrades require an explicit review.

5. Verify image provenance and signatures using the official Knative release metadata and an appropriate verification mechanism before execution.

6. Where practical, use a short-lived Kubernetes token with narrowly scoped RBAC permissions and revoke or expire it after the operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/kn-cli.md (reported line 32)May include surrounding context.

kn version

text

For temporary use, run the official container image with kubeconfig mounted:

```bash
docker run --rm -v "$HOME/.kube/config:/root/.kube/config" gcr.io/knative-releases/knative.dev/client/cmd/kn:latest service list

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Mounting $HOME/.kube/config into a container exposes Kubernetes credentials and cluster access to whatever runs inside that image. This is especially risky here because the example also uses a mutable latest image tag, so users may grant live cluster credentials to unpinned code.

Content

Scanner excerpt · references/kn-cli.md (reported line 35)May include surrounding context.

For temporary use, run the official container image with kubeconfig mounted:

bash

docker run --rm -v "$HOME/.kube/config:/root/.kube/config" gcr.io/knative-releases/knative.dev/client/cmd/kn:latest service list

Service lifecycle

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The example uses a container image tagged latest, which is mutable and can change over time without review. In a security-sensitive context where the container is given access to the user's kubeconfig, this increases supply-chain risk because a future image change could gain cluster credentials unexpectedly.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/kn-cli.md (reported line 35)May include surrounding context.

For temporary use, run the official container image with kubeconfig mounted:

bash

docker run --rm -v "$HOME/.kube/config:/root/.kube/config" gcr.io/knative-releases/knative.dev/client/cmd/kn:latest service list

Service lifecycle

Static analysis

No suspicious patterns detected.