Kubernetes

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:36 PM UTC
• Version: 1.0.0

Overview

This is a coherent Kubernetes manifest guidance skill with some deployment-safety caveats, but no hidden execution, credential theft, exfiltration, or destructive behavior was found.

Before installing, prefer a pinned package version or immutable commit instead of @latest or a branch URL. Before applying generated YAML, review any LoadBalancer, NodePort, 0.0.0.0/0, Secret, hostPath, or remote kubectl apply examples against your cluster security policy.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:31
• Finding: Unpinned Remote Installation Commands Allow Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Locations**: - `README.md:31-38` - `SKILL.md:24-28` - `k8s-manifest-generator/README.md:31-32` **Vulnerability Type**: Unpinned third-party installers and mutable remote sources **Risk Level**: Medium ### Vulnerable Code `README.md:31-38`: ```bash npx add https://github.com/wpank/ai/tree/main/skills/devops/kubernetes ``` ```bash npx clawhub@latest install kubernetes ``` `SKILL.md:24-28`: ```bash npx clawhub@latest install kubernetes ``` `k8s-manifest-generator/README.md:31-32`: ```bash npx add https://github.com/wpank/ai/tree/main/skills/devops/kubernetes/k8s-manifest-generator ``` ### Technical Analysis The installation documentation instructs users to invoke packages through `npx`. This mechanism can download and execute npm package code under the privileges of the current user. The command using `clawhub@latest` explicitly selects a mutable package release instead of a reviewed and pinned version. The GitHub-based commands also refer to repository branch paths rather than immutable commit hashes. As a result, the content executed or installed by these commands may change after this version of the Skill has been audited. No evidence establishes that the current upstream packages or repository are malicious. The vulnerability is the absence of immutable dependency pinning and integrity verification, which creates a supply-chain trust boundary outside the audited project. ### Attack Path 1. An attacker compromises the npm publisher account, npm package, GitHub account, or upstream repository used by the documented installation command. 2. The attacker publishes a malicious `latest` package version or modifies content reachable through the mutable repository path. 3. A user follows the installation instructions and runs the documented `npx` command. 4. `npx` retrieves the altered package or installer from the external source. 5. Package lifecycle or installer code executes in the user's environment. 6. The ...[truncated 1091 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specifically reviewed package version: ```bash npx clawhub@<verified-version> install kubernetes ``` 2. Pin GitHub-hosted content to a full immutable commit hash rather than a mutable branch: ```text https://github.com/wpank/ai/tree/<full-commit-hash>/skills/devops/kubernetes ``` 3. Publish and document cryptographic checksums or signed release artifacts so users can verify integrity before installation. 4. Prefer a download-review-install workflow over directly executing remotely retrieved package code. 5. Document the expected package publisher, repository owner, release version, commit hash, and checksum. 6. Configure CI security checks to detect installation instructions containing mutable selectors such as `@latest`, unpinned Git branches, or unverified remote installers. 7. Advise users not to run installation commands with administrator or root privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Credential Access

High

• Category: Privilege Escalation

Content

```
manifests/
├── configmap.yaml
├── secret.yaml
├── deployment.yaml
├── service.yaml
└── pvc.yaml

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```
manifests/
├── configmap.yaml
├── secret.yaml
├── deployment.yaml
├── service.yaml
└── pvc.yaml

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High

• Category: analysis-evasion

Content

| [assets/ingress-template.yaml](assets/ingress-template.yaml) | Ingress with TLS, rate limiting, CORS |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Privileged Kubernetes Workload

High

• Category: Tool Misuse

Content

# HostPath (avoid in production)
  - name: host-data
    hostPath:
      path: /data
      type: DirectoryOrCreate
```

• Confidence: 55% confidence
• Finding: Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Privileged Kubernetes Workload

High

• Category: Tool Misuse

Content

# HostPath (avoid in production)
  - name: host-data
    hostPath:
      path: /data
      type: DirectoryOrCreate
```

• Confidence: 55% confidence
• Finding: Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute remote package installation commands via `npx add` against a GitHub URL without pinning a specific immutable version or commit. This creates a supply-chain risk because the referenced content can change over time, causing future installs to execute different code than what was originally reviewed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: Using `npx clawhub@latest install kubernetes` pulls and executes the latest published package version at runtime, which is not reproducible and increases exposure to upstream compromise or malicious package updates. Even if the current package is legitimate, `@latest` means users implicitly trust all future releases.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/devops/kubernetes .cursor/skills/kubernetes
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
model: fast
description: |
  WHAT: Kubernetes manifest generation - Deployments, StatefulSets, CronJobs, Services, Ingresses, 
  ConfigMaps, Secrets, and PVCs with production-grade security and health checks.

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
model: fast
description: |
  WHAT: Kubernetes manifest generation - Deployments, StatefulSets, CronJobs, Services, Ingresses, 
  ConfigMaps, Secrets, and PVCs with production-grade security and health checks.

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The installation command uses `npx clawhub@latest install kubernetes`, which resolves and executes the latest published package version at runtime. This creates a supply-chain risk because a compromised or maliciously updated package could be executed by users without review or reproducibility guarantees.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

|-------------|-----|------------|
| Use `:latest` image tag | Non-reproducible deployments | Pin exact version: `image:1.2.3` |
| Skip resource limits | Pods can starve the node | Always set `requests` and `limits` |
| Run as root | Container escape = full host access | Set `runAsNonRoot: true` + `USER` |
| Commit plaintext Secrets | Credentials in Git history forever | Use Sealed Secrets / External Secrets / Vault |
| Skip health checks | K8s can't detect unhealthy pods | Always configure liveness + readiness probes |
| Omit labels | Cannot filter, select, or organize | Use standard `app.kubernetes.io/*` labels |

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The LoadBalancer and NodePort templates facilitate external exposure of workloads, but the template does not prominently warn users that these service types can publish an application to the internet or broader network if left unmodified. In a manifest-generation skill, users may copy these examples directly into production, so the omission increases the risk of unintended public exposure, especially since the LoadBalancer example is explicitly configured as internet-facing and access restrictions are only commented as optional.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The README instructs users to install the skill directly from a GitHub URL via `npx add` without any pinned version, commit SHA, or integrity mechanism. That creates a supply-chain risk because future upstream changes to the referenced repository could alter what gets installed, causing users to fetch unreviewed or malicious content.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator .cursor/skills/k8s-manifest-generator
```

• Confidence: 70% confidence
• Finding: The README explicitly instructs users to copy the skill into persistent per-project and global agent skill directories such as `.cursor/skills` and `~/.cursor/skills`. Persisting agent-executable content in auto-loaded locations increases risk because a compromised or later-modified skill may continue to influence future sessions and projects beyond the initial install.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator .claude/skills/k8s-manifest-generator
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator .claude/skills/k8s-manifest-generator
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator ~/.claude/skills/k8s-manifest-generator
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/devops/kubernetes/k8s-manifest-generator ~/.claude/skills/k8s-manifest-generator
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill includes a Kubernetes Secret manifest with plaintext example values and only briefly warns against committing secrets to Git. It does not clearly explain that Kubernetes Secrets are merely base64-encoded and remain accessible in-cluster to principals with Secret read access, which can normalize unsafe handling and lead users to generate and store sensitive values insecurely.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The template presents an internet-facing LoadBalancer as a standard option and defaults the AWS scheme to "internet-facing", which can lead users to expose workloads publicly without fully understanding the security implications. Although comments mention optional source-range restriction and optional TLS certificate use, the template does not strongly gate or warn against public exposure, making accidental external attack-surface creation more likely in a manifest-generation skill.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The NodePort template exposes an application directly on every cluster node and is presented without strong guidance about when it is appropriate, increasing the chance of broad unintended external reachability. In a manifest-generation skill intended for production-grade deployments, providing NodePort as a ready-to-use template without prominent caveats can normalize an unnecessarily exposed service pattern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example for a public API LoadBalancer includes `loadBalancerSourceRanges: [0.0.0.0/0]`, which permits access from any IPv4 source and effectively documents internet-wide exposure as a normal pattern. In a manifest-generation reference used to produce production Kubernetes configs, this can lead users to deploy broadly exposed services without understanding the risk, increasing attack surface for scanning, abuse, and exploitation of the backend service.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The example shows a public LoadBalancer with `loadBalancerSourceRanges: 0.0.0.0/0`, which explicitly permits access from any IPv4 address on the internet. In a manifest-generation reference intended for production use, this can normalize unsafe defaults and lead users to deploy internet-exposed services without understanding the exposure or compensating controls such as authentication, WAFs, or restricted CIDRs.

Description-Behavior Mismatch

Low

• Confidence: 86% confidence
• Finding: The manifest description at L004-L011 scopes the skill to Deployments, StatefulSets, CronJobs, Services, Ingresses, ConfigMaps, Secrets, and PVCs. However, the 'Workload Selection' section explicitly documents DaemonSet usage at L050, expanding behavior beyond the declared resource types.

Static analysis

No suspicious patterns detected.