kubevpn

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:51 AM UTC
• Version: 2.9.14

Overview

This skill is coherent Kubernetes tooling documentation, but it needs Review because it recommends unsafe installation and high-impact Kubernetes/Docker actions with limited safety guidance.

Install only through a trusted package manager or a verified signed release, not the pipe-to-shell command. Use least-privilege kubeconfigs, avoid inline tokens/passwords, prefer non-production namespaces, use header-based routing when possible, check what resources will be injected or deployed, avoid privileged local containers unless truly required, and run cleanup commands after use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:26

Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Remediation

View remediation

kubevpn.tar.gz" | sha256sum --check - ``` 6. Extract and install only after successful verification. 7. Prefer package managers that support signed, versioned packages. 8. Document whether installation requires elevated privileges and ensure elevation is limited to the exact filesystem operation that needs it. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/commands.md:225

Finding

Local Workload Containers Run with Extended Privileges by Default

Content

View full analysis

` to reproduce or debug the workload locally. 4. KubeVPN pulls and starts the attacker-controlled image. 5. According to the documented default, the container receives extended privileges without the user explicitly requesting them. 6. Malicious code abuses the additional capabilities or device access to inspect or modify host resources, interfere with networking, or attempt a container esca ...[truncated 718 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (29)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The command fetches a script from the internet and pipes it directly to sh, creating a classic remote code execution risk. Because this skill is for developer tooling that bridges into Kubernetes environments, compromise of the local machine could also expose kubeconfigs, cloud credentials, SSH keys, and access to clusters.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash

brew install kubevpn                              # macOS
curl -fsSL https://kubevpn.dev/install.sh | sh   # Linux/macOS
kubectl krew install kubevpn/kubevpn              # kubectl plugin
scoop bucket add extras && scoop install kubevpn  # Windows

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

All connect/proxy/run/sync commands support SSH jump:

bash

kubevpn connect --ssh-addr 192.168.1.100:22 --ssh-username root --ssh-keyfile ~/.ssh/id_rsa
kubevpn connect --ssh-alias dev                           # uses ~/.ssh/config alias
kubevpn proxy deployment/<name> --ssh-alias dev --headers foo=bar

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/commands.md (reported line 45)May include surrounding context.

md

| `--image-pull-secret-name` | Secret name for pulling image from private registry |
| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/commands.md (reported line 118)May include surrounding context.

md

| `--image-pull-secret-name` | Secret name for pulling image from private registry |
| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/commands.md (reported line 176)May include surrounding context.

md

| `--image-pull-secret-name` | Secret name for pulling image from private registry |
| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/commands.md (reported line 232)May include surrounding context.

md

| `--image-pull-secret-name` | Secret name for pulling image from private registry |
| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 46)May include surrounding context.

md

| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

**Examples:**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 248)May include surrounding context.

md

| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

**Examples:**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 298)May include surrounding context.

md

| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

**Examples:**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 305)May include surrounding context.

md

| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

**Examples:**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 496)May include surrounding context.

md

| `--manager-namespace` | Namespace of traffic manager (when installed via Helm) |
| `--transfer-image` | Transfer kubevpn image to a custom registry before use |
| `--debug` | Enable debug mode |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| + SSH jump flags | See [SSH Jump Flags](#ssh-jump-flags) |

**Examples:**

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The run command documents --privileged with a default of true, meaning locally launched containers may receive broad host-level capabilities by default. In a development tool that also imports pod env vars, volumes, and networking from clusters, this materially increases the risk of container escape, host tampering, and abuse of sensitive mounted content if images or workloads are untrusted or compromised.

Content

Scanner excerpt · references/commands.md (reported line 225)May include surrounding context.

md

| `--connect-mode` | | `host` or `container` network mode (default: `host`) |
| `--image` | | kubevpn sidecar image |
| `--platform` | | Platform for multi-platform images |
| `--privileged` | | Run container with extended privileges (default: `true`) |
| `--publish` | `-p` | Publish container port(s) to host |
| `--publish-all` | `-P` | Publish all exposed ports to random ports |
| `--expose` | | Expose a port or range |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 248)May include surrounding context.

kubevpn run deployment/authors --dev-image golang:1.21 --entrypoint bash

Via SSH alias

kubevpn run deployment/authors -n default --kubeconfig ~/.kube/config --ssh-alias dev --entrypoint /bin/bash

text

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 298)May include surrounding context.

kubevpn run deployment/authors --dev-image golang:1.21 --entrypoint bash

Via SSH alias

kubevpn run deployment/authors -n default --kubeconfig ~/.kube/config --ssh-alias dev --entrypoint /bin/bash

text

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The alias config supports inline --kubeconfig-json={...}, which encourages embedding cluster credentials directly into configuration entries that may be stored in plaintext, copied, logged, or committed to source control. In an agent skill context, inline secrets are especially risky because assistants may echo, persist, or expose command strings and config content across sessions or logs.

Content

Scanner excerpt · references/commands.md (reported line 309)May include surrounding context.

md

- --namespace=test
---
Name: all-in-one
Description: inline kubeconfig via JSON
Flags:
- connect
- --kubeconfig-json={"apiVersion":"v1","clusters":[...]}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

This line continues the inline kubeconfig JSON pattern, which can expose bearer tokens, client certificates, or cluster credentials in plaintext configuration and operational logs. Because the skill is designed for agent-driven use, such inline secrets can be unintentionally surfaced in transcripts, telemetry, or generated examples.

Content

Scanner excerpt · references/commands.md (reported line 312)May include surrounding context.

Description: inline kubeconfig via JSON Flags:

• connect
• --kubeconfig-json={"apiVersion":"v1","clusters":[...]}
• --namespace=test

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 497)May include surrounding context.

md

| Flag | Description |
|------|-------------|
| `--kubeconfig` | Path to kubeconfig file |
| `--context` | Kubeconfig context to use |
| `-n`, `--namespace` | Namespace scope |
| `--cluster` | Kubeconfig cluster to use |
| `--user` | Kubeconfig user to use |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 500)May include surrounding context.

md

| Flag | Description |
|------|-------------|
| `--kubeconfig` | Path to kubeconfig file |
| `--context` | Kubeconfig context to use |
| `-n`, `--namespace` | Namespace scope |
| `--cluster` | Kubeconfig cluster to use |
| `--user` | Kubeconfig user to use |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Documenting a raw --token flag makes direct bearer-token use easy, which raises the chance users pass long-lived secrets on command lines where they can leak via shell history, process listings, terminal scrollback, or agent logs. In this skill context, that risk is elevated because assistants may generate or repeat full commands containing sensitive tokens.

Content

Scanner excerpt · references/commands.md (reported line 499)May include surrounding context.

md

| `--kubeconfig` | Path to kubeconfig file |
| `--context` | Kubeconfig context to use |
| `-n`, `--namespace` | Namespace scope |
| `--cluster` | Kubeconfig cluster to use |
| `--user` | Kubeconfig user to use |
| `--server` / `-s` | Kubernetes API server address |
| `--token` | Bearer token for API server auth |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This section documents sensitive authentication inputs including SSH private keys, GSSAPI password, and remote kubeconfig use, and even provides an inline example string carrying a password-like value. In an agent setting, documenting or generating commands with inline secrets can lead to exposure in shell history, process arguments, chat logs, and telemetry.

Content

Scanner excerpt · references/commands.md (reported line 525)May include surrounding context.

md

| `--ssh-keyfile` | Path to SSH private key file |
| `--ssh-alias` | SSH config alias from `~/.ssh/config` |
| `--ssh-jump` | Inline ProxyJump config string eg: `--ssh-addr jump.example.org --ssh-username user --gssapi-password xxx` |
| `--remote-kubeconfig` | Path to kubeconfig on remote SSH server |
| `--gssapi-keytab` | GSSAPI keytab file path |
| `--gssapi-cache` | GSSAPI cache file path (from `kinit -c`) |
| `--gssapi-password` | GSSAPI password |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The installation section recommends curl -fsSL https://kubevpn.dev/install.sh | sh, which executes remote code directly in a shell without verification. If the site, transport, or upstream script is compromised, users could run arbitrary attacker-controlled code on their local machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown describes proxy as intercepting inbound cluster traffic and notes that it auto-connects, but it does not explicitly warn users that this can redirect real traffic from a live Kubernetes workload to their local machine. Similar traffic-affecting behavior is described for run and sync, yet the document presents them as workflows without a user-facing caution about operational impact.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The skill states that server components are auto-deployed on first use and that several commands auto-connect to clusters. In a Kubernetes context, implicit deployment and connection behavior can cause unauthorized or unexpected changes to cluster state, especially in production or shared environments.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

- `proxy`, `run`, and `sync` auto-connect to the cluster if not already connected
- Multiple clusters can be connected simultaneously; use `kubevpn status` or `kubevpn connection list` to inspect
- `disconnect` cleans up DNS/hosts; `quit` also stops the daemon gRPC server entirely
- Server components are auto-deployed on first use (or pre-install: `helm install kubevpn kubevpn/kubevpn`)
- Supports HTTP, gRPC, Thrift, WebSocket, TCP, UDP, ICMP
- Use `kubevpn reset deployment/<name>` if a workload gets stuck with injected containers
- Use `kubevpn image copy` to mirror images to a private registry when `ghcr.io` is not accessible

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation describes injecting a sidecar, rewriting iptables, and intercepting all inbound traffic to a live workload, but does not prominently warn that this can disrupt production or staging services. In the context of a Kubernetes networking tool, omission of this warning is dangerous because users may unintentionally reroute or blackhole real traffic and affect availability.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/architecture.md (reported line 52)May include surrounding context.

md

## Server Component (traffic-manager)

On first `kubevpn connect`, kubevpn auto-deploys a `traffic-manager` deployment in the target
namespace. This pod:
- Terminates the TUN tunnel from the local machine
- Acts as a gateway for routing traffic between local and cluster networks