Kubernetes

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:36 PM UTC
• Version: 1.0.0

Overview

This is a coherent Kubernetes manifest guidance skill with some deployment-safety caveats, but no hidden execution, credential theft, exfiltration, or destructive behavior was found.

Before installing, prefer a pinned package version or immutable commit instead of @latest or a branch URL. Before applying generated YAML, review any LoadBalancer, NodePort, 0.0.0.0/0, Secret, hostPath, or remote kubectl apply examples against your cluster security policy.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:31

Finding

Unpinned Remote Installation Commands Allow Supply-Chain Code Execution

Content

View full analysis

Remediation

View remediation

install kubernetes ``` 2. Pin GitHub-hosted content to a full immutable commit hash rather than a mutable branch: ```text https://github.com/wpank/ai/tree//skills/devops/kubernetes ``` 3. Publish and document cryptographic checksums or signed release artifacts so users can verify integrity before installation. 4. Prefer a download-review-install workflow over directly executing remotely retrieved package code. 5. Document the expected package publisher, repository owner, release version, commit hash, and checksum. 6. Configure CI security checks to detect installation instructions containing mutable selectors such as `@latest`, unpinned Git branches, or unverified remote installers. 7. Advise users not to run installation commands with administrator or root privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

text

manifests/
├── configmap.yaml
├── secret.yaml
├── deployment.yaml
├── service.yaml
└── pvc.yaml

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · k8s-manifest-generator/SKILL.md (reported line 371)May include surrounding context.

text

manifests/
├── configmap.yaml
├── secret.yaml
├── deployment.yaml
├── service.yaml
└── pvc.yaml

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

md

| [assets/ingress-template.yaml](assets/ingress-template.yaml) | Ingress with TLS, rate limiting, CORS |

Privileged Kubernetes Workload

High

• Category: Tool Misuse
• Confidence: 55% confidence

Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · k8s-manifest-generator/references/deployment-spec.md (reported line 538)May include surrounding context.

HostPath (avoid in production)

• name: host-data hostPath: path: /data type: DirectoryOrCreate

text

Privileged Kubernetes Workload

High

• Category: Tool Misuse
• Confidence: 55% confidence

Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · references/deployment-spec.md (reported line 538)May include surrounding context.

HostPath (avoid in production)

• name: host-data hostPath: path: /data type: DirectoryOrCreate

text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute remote package installation commands via npx add against a GitHub URL without pinning a specific immutable version or commit. This creates a supply-chain risk because the referenced content can change over time, causing future installs to execute different code than what was originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx clawhub@latest install kubernetes pulls and executes the latest published package version at runtime, which is not reproducible and increases exposure to upstream compromise or malicious package updates. Even if the current package is legitimate, @latest means users implicitly trust all future releases.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/devops/kubernetes .cursor/skills/kubernetes

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.

md

---
model: fast
description: |
  WHAT: Kubernetes manifest generation - Deployments, StatefulSets, CronJobs, Services, Ingresses, 
  ConfigMaps, Secrets, and PVCs with production-grade security and health checks.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · k8s-manifest-generator/SKILL.md (reported line 3)May include surrounding context.

md

---
model: fast
description: |
  WHAT: Kubernetes manifest generation - Deployments, StatefulSets, CronJobs, Services, Ingresses, 
  ConfigMaps, Secrets, and PVCs with production-grade security and health checks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses npx clawhub@latest install kubernetes, which resolves and executes the latest published package version at runtime. This creates a supply-chain risk because a compromised or maliciously updated package could be executed by users without review or reproducibility guarantees.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

md

|-------------|-----|------------|
| Use `:latest` image tag | Non-reproducible deployments | Pin exact version: `image:1.2.3` |
| Skip resource limits | Pods can starve the node | Always set `requests` and `limits` |
| Run as root | Container escape = full host access | Set `runAsNonRoot: true` + `USER` |
| Commit plaintext Secrets | Credentials in Git history forever | Use Sealed Secrets / External Secrets / Vault |
| Skip health checks | K8s can't detect unhealthy pods | Always configure liveness + readiness probes |
| Omit labels | Cannot filter, select, or organize | Use standard `app.kubernetes.io/*` labels |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The LoadBalancer and NodePort templates facilitate external exposure of workloads, but the template does not prominently warn users that these service types can publish an application to the internet or broader network if left unmodified. In a manifest-generation skill, users may copy these examples directly into production, so the omission increases the risk of unintended public exposure, especially since the LoadBalancer example is explicitly configured as internet-facing and access restrictions are only commented as optional.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to install the skill directly from a GitHub URL via npx add without any pinned version, commit SHA, or integrity mechanism. That creates a supply-chain risk because future upstream changes to the referenced repository could alter what gets installed, causing users to fetch unreviewed or malicious content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 70% confidence

Finding

The README explicitly instructs users to copy the skill into persistent per-project and global agent skill directories such as .cursor/skills and ~/.cursor/skills. Persisting agent-executable content in auto-loaded locations increases risk because a compromised or later-modified skill may continue to influence future sessions and projects beyond the initial install.

Content

Scanner excerpt · k8s-manifest-generator/README.md (reported line 42)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator .cursor/skills/k8s-manifest-generator

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator .claude/skills/k8s-manifest-generator

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · k8s-manifest-generator/README.md (reported line 58)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator .claude/skills/k8s-manifest-generator

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 71)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator ~/.claude/skills/k8s-manifest-generator

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · k8s-manifest-generator/README.md (reported line 65)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator ~/.claude/skills/k8s-manifest-generator

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill includes a Kubernetes Secret manifest with plaintext example values and only briefly warns against committing secrets to Git. It does not clearly explain that Kubernetes Secrets are merely base64-encoded and remain accessible in-cluster to principals with Secret read access, which can normalize unsafe handling and lead users to generate and store sensitive values insecurely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template presents an internet-facing LoadBalancer as a standard option and defaults the AWS scheme to "internet-facing", which can lead users to expose workloads publicly without fully understanding the security implications. Although comments mention optional source-range restriction and optional TLS certificate use, the template does not strongly gate or warn against public exposure, making accidental external attack-surface creation more likely in a manifest-generation skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The NodePort template exposes an application directly on every cluster node and is presented without strong guidance about when it is appropriate, increasing the chance of broad unintended external reachability. In a manifest-generation skill intended for production-grade deployments, providing NodePort as a ready-to-use template without prominent caveats can normalize an unnecessarily exposed service pattern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example for a public API LoadBalancer includes loadBalancerSourceRanges: [0.0.0.0/0], which permits access from any IPv4 source and effectively documents internet-wide exposure as a normal pattern. In a manifest-generation reference used to produce production Kubernetes configs, this can lead users to deploy broadly exposed services without understanding the risk, increasing attack surface for scanning, abuse, and exploitation of the backend service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example shows a public LoadBalancer with loadBalancerSourceRanges: 0.0.0.0/0, which explicitly permits access from any IPv4 address on the internet. In a manifest-generation reference intended for production use, this can normalize unsafe defaults and lead users to deploy internet-exposed services without understanding the exposure or compensating controls such as authentication, WAFs, or restricted CIDRs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description at L004-L011 scopes the skill to Deployments, StatefulSets, CronJobs, Services, Ingresses, ConfigMaps, Secrets, and PVCs. However, the 'Workload Selection' section explicitly documents DaemonSet usage at L050, expanding behavior beyond the declared resource types.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.