K8s

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 0.1.0

Overview

This Kubernetes skill is openly for cluster administration, but it combines powerful cluster access with remote credential handling, persistent caching, and unverified executable download behavior.

Review before installing. Use only least-privilege kubeconfigs from trusted sources, prefer a preinstalled kubectl, avoid remote kubeconfig URLs, never use --insecure for credential material, and clear the cache after use if remote kubeconfigs are used.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:100

Finding

Unverified Remote kubectl Binary Download and Execution

Content

View full analysis

/bin/kubectl`. The cache directory is added to `PATH` for the duration of the command. - **Kubeconfig caching:** Remote kubeconfigs are hashed by URL (sha256) and stored at `/kubeconfigs/.yaml`. Use `--refresh` to bypass the cache. - **Secrets:** Downloaded kubeconfigs are written with `chmod 600`. Avoid logging the file contents. - **Cross-platform:** The wrapper auto-detects Linux/macOS and amd64/arm64 for kubectl downloads. ``` The same behavior is introduced at `SKILL.md:22-27`: ```markdown The main entry point is `scripts/k8s.sh`. It is a thin wrapper that: 1. Ensures `kubectl` is installed (downloads it via the DaoCloud mirror if missing). 2. Resolves the kubeconfig (downloads it to a cached path if a URL is given). 3. Invokes `kubectl --kubeconfig= `. ``` ### Technical Analysis The skill specification directs its wrapper to download an executable from a third-party mirror and then invoke that executable with access to Kubernetes credentials. It does not prescribe a pinned version, expected cryptographic digest, authenticated signature, or verification against an official Kubernetes release manifest. TLS protects transport only while the mirror and its certificate infrastructure remain trustworthy. It does not protect against mirror compromise, upstream replacement, administrative mistakes, or mutable content served from the download location. Because the downloaded artifact is executable code, i ...[truncated 1895 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:69

Finding

Unsafe Retrieval and Consumption of Arbitrary Remote Kubeconfig Files

Content

View full analysis

` | `KUBECONFIG_PATH` | Local kubeconfig file path. | | `--kubeconfig-url ` | `KUBECONFIG_URL` | Remote kubeconfig URL (http/https). Downloaded once and cached. | | `--cache-dir ` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. | | `--refresh` | - | Force re-download of the remote kubeconfig even if cached. | | `--kubectl ` | `KUBECTL_BIN` | Use a specific kubectl binary instead of auto-detect/install. | | `--insecure` | - | Pass `-k` to `curl` when downloading the kubeconfig (use only for trusted self-signed endpoints). | ``` Related caching behavior is documented at `SKILL.md:103-104`: ```markdown - **Kubeconfig caching:** Remote kubeconfigs are hashed by URL (sha256) and stored at `/kubeconfigs/.yaml`. Use `--refresh` to bypass the cache. - **Secrets:** Downloaded kubeconfigs are written with `chmod 600`. Avoid logging the file contents. ``` ### Technical Analysis Kubeconfig files are security-sensitive active configuration, not merely passive connection metadata. They may contain bearer tokens, client keys, cluster endpoints, certificate-authority settings, and executable credential-provider configuration under `users[].user.exec`. The documented interface permits plain HTTP URLs and provides an `--insecure` option that disables TLS certificate verification. Either mode can allow a network attacker to replace the kubeconfig during download. A malicious or compromised source can also intentionally supply hostile configuration. When `kubectl` processes an attacker-controlled kubeconfig, an `exec` credential plugin can cause a local ...[truncated 2411 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (38)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill is explicitly designed to consume kubeconfig material, which commonly carries credentials granting cluster access. In this context, accepting local paths or remote URLs for kubeconfigs creates a real credential-handling surface, especially because the skill also supports download and caching of those credentials.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: k8s
description: Operate Kubernetes clusters via kubectl with a user-supplied kubeconfig (local file path or remote URL). This skill should be used when users want to inspect or manage Kubernetes resources (pods, deployments, services, nodes, namespaces, logs, exec, apply, etc.) against an arbitrary cluster. The skill auto-downloads remote kubeconfigs to a cached location and auto-installs `kubectl` if it is missing.
---

# Kubernetes (k8s) Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This line describes operating against any cluster using a local or remote kubeconfig, which means the skill directly handles cluster credentials and trust material. In a Kubernetes administration skill, that is expected functionality, but it is still security-sensitive because misuse or leakage of kubeconfigs can grant broad access to infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

# Kubernetes (k8s) Skill

Run `kubectl` against any cluster by pointing at a local kubeconfig file or a remote kubeconfig URL. Bootstrap (kubectl install + kubeconfig download) is handled automatically.

## When to Use

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill normalizes use of remote kubeconfig URLs and cached local storage without clearly warning that kubeconfigs often contain bearer tokens, client certs, or references to credential plugins. Downloading and persisting these files can expose cluster credentials to local compromise, mishandling, or reuse beyond the user’s expectation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises management operations such as apply, delete, and edit without an explicit warning that these can change or disrupt live clusters. Because the skill is intended for arbitrary user-supplied clusters, omission of a destructive-operation warning materially raises the risk of accidental outages or unauthorized changes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Supporting one-off clusters whose kubeconfig is published at an HTTP(S) URL materially increases credential exposure and trust risk. A remotely hosted kubeconfig can be substituted, tampered with, or point to unexpected clusters or auth mechanisms, leading to credential theft or unintended administrative access.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- Inspect Kubernetes resources (e.g. `kubectl get pods -A`, `kubectl describe node ...`)
- Apply / delete / edit manifests (`kubectl apply -f`, `kubectl delete`, `kubectl rollout`)
- Stream logs, exec into pods, port-forward, or run any other `kubectl` subcommand
- Run against a one-off cluster whose kubeconfig is published at an HTTP(S) URL

## Usage

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The wrapper’s documented behavior includes resolving kubeconfigs by downloading them to a cached path, which is direct handling of credentials. Caching sensitive cluster access material on disk expands the attack surface to local users, backups, logs, or later unintended reuse.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

The main entry point is `scripts/k8s.sh`. It is a thin wrapper that:

1. Ensures `kubectl` is installed (downloads it via the DaoCloud mirror if missing).
2. Resolves the kubeconfig (downloads it to a cached path if a URL is given).
3. Invokes `kubectl --kubeconfig=<resolved-path> <your args...>`.

### Local kubeconfig

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The explicit invocation 'kubectl --kubeconfig=' confirms the wrapper passes credential-bearing configuration directly into an administrative CLI. That is inherently security-sensitive because the kubeconfig may embed tokens, client keys, or exec-based credential retrieval, and any mishandling can expose cluster access.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

1. Ensures `kubectl` is installed (downloads it via the DaoCloud mirror if missing).
2. Resolves the kubeconfig (downloads it to a cached path if a URL is given).
3. Invokes `kubectl --kubeconfig=<resolved-path> <your args...>`.

### Local kubeconfig

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The 'Local kubeconfig' section instructs direct use of a local credential file for cluster access. While standard for kubectl workflows, it is a true credential-handling concern because users may inadvertently point the skill at highly privileged configs or expose sensitive file paths and contexts through automation.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

2. Resolves the kubeconfig (downloads it to a cached path if a URL is given).
3. Invokes kubectl --kubeconfig=<resolved-path> <your args...>.

Local kubeconfig

bash

bash scripts/k8s.sh \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The example uses a direct kubeconfig path, reinforcing that the skill will operate with whatever privileges are encoded in that file. In an agent setting, this is risky because the command pathway may be reused for broad cluster administration without guardrails or privilege checks.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash

bash scripts/k8s.sh \
  --kubeconfig /path/to/kubeconfig.yaml \
  -- get pods -A

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The dedicated 'Remote kubeconfig URL' workflow highlights retrieval of credentials over the network, which is more dangerous than local-only usage. This creates opportunities for man-in-the-middle issues, maliciously crafted kubeconfigs, or accidental persistence of third-party credentials on disk.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

-- get pods -A

text

### Remote kubeconfig URL

```bash
bash scripts/k8s.sh \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The example with '--kubeconfig-url https://example.com/kubeconfig.yaml' demonstrates pulling live credentials/configuration from a remote endpoint and immediately using them for cluster access. That workflow can expose the user to malicious configs or silent access to the wrong cluster if provenance is not verified.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

bash

bash scripts/k8s.sh \
  --kubeconfig-url https://example.com/kubeconfig.yaml \
  -- get nodes -o wide

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Allowing kubeconfig sources via environment variables broadens the credential ingestion surface. Environment variables are often easier to leak through shell history, process inspection, CI logs, or inherited subprocess environments than explicit file references.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

Via environment variables

--kubeconfig and --kubeconfig-url can also be supplied via env vars:

bash

export KUBECONFIG_URL=https://example.com/kubeconfig.yaml

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This example reiterates environment-driven remote kubeconfig handling, which remains a true credential-access concern in this skill context. Even though the line is documentation, it instructs a workflow that can expose cluster credentials and remote trust decisions to less visible channels.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

--kubeconfig and --kubeconfig-url can also be supplied via env vars:

bash

export KUBECONFIG_URL=https://example.com/kubeconfig.yaml
bash scripts/k8s.sh -- get ns

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This example reiterates environment-driven remote kubeconfig handling, which remains a true credential-access concern in this skill context. Even though the line is documentation, it instructs a workflow that can expose cluster credentials and remote trust decisions to less visible channels.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

--kubeconfig and --kubeconfig-url can also be supplied via env vars:

bash

export KUBECONFIG_URL=https://example.com/kubeconfig.yaml
bash scripts/k8s.sh -- get ns

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This line’s kubeconfig example reinforces use of environment-based credential selection without any safety caveat. In an automated skill, such patterns can lead to accidental execution against the wrong cluster if a stale environment variable remains set.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Or:

bash

export KUBECONFIG_PATH=/path/to/kubeconfig.yaml
bash scripts/k8s.sh -- get ns

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This line’s kubeconfig example reinforces use of environment-based credential selection without any safety caveat. In an automated skill, such patterns can lead to accidental execution against the wrong cluster if a stale environment variable remains set.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Or:

bash

export KUBECONFIG_PATH=/path/to/kubeconfig.yaml
bash scripts/k8s.sh -- get ns

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The KUBECONFIG_PATH/KUBECONFIG_URL environment variables in the flag table formalize a credential-bearing interface to the skill. This is not malicious, but it is a true security-sensitive design element because it enables silent use of privileged credentials from ambient process state.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| Flag | Env Var | Description |
|------|---------|-------------|
| `--kubeconfig <path>` | `KUBECONFIG_PATH` | Local kubeconfig file path. |
| `--kubeconfig-url <url>` | `KUBECONFIG_URL` | Remote kubeconfig URL (http/https). Downloaded once and cached. |
| `--cache-dir <dir>` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. |
| `--refresh` | - | Force re-download of the remote kubeconfig even if cached. |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The KUBECONFIG_PATH/KUBECONFIG_URL environment variables in the flag table formalize a credential-bearing interface to the skill. This is not malicious, but it is a true security-sensitive design element because it enables silent use of privileged credentials from ambient process state.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| Flag | Env Var | Description |
|------|---------|-------------|
| `--kubeconfig <path>` | `KUBECONFIG_PATH` | Local kubeconfig file path. |
| `--kubeconfig-url <url>` | `KUBECONFIG_URL` | Remote kubeconfig URL (http/https). Downloaded once and cached. |
| `--cache-dir <dir>` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. |
| `--refresh` | - | Force re-download of the remote kubeconfig even if cached. |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The associated environment variable for remote kubeconfig URLs introduces the same risks while making the source less visible at invocation time. Hidden or inherited configuration is especially dangerous in agent workflows because it can cause execution against unintended credentials or clusters.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

| Flag | Env Var | Description |
|------|---------|-------------|
| `--kubeconfig <path>` | `KUBECONFIG_PATH` | Local kubeconfig file path. |
| `--kubeconfig-url <url>` | `KUBECONFIG_URL` | Remote kubeconfig URL (http/https). Downloaded once and cached. |
| `--cache-dir <dir>` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. |
| `--refresh` | - | Force re-download of the remote kubeconfig even if cached. |
| `--kubectl <path>` | `KUBECTL_BIN` | Use a specific kubectl binary instead of auto-detect/install. |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The associated environment variable for remote kubeconfig URLs introduces the same risks while making the source less visible at invocation time. Hidden or inherited configuration is especially dangerous in agent workflows because it can cause execution against unintended credentials or clusters.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

| Flag | Env Var | Description |
|------|---------|-------------|
| `--kubeconfig <path>` | `KUBECONFIG_PATH` | Local kubeconfig file path. |
| `--kubeconfig-url <url>` | `KUBECONFIG_URL` | Remote kubeconfig URL (http/https). Downloaded once and cached. |
| `--cache-dir <dir>` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. |
| `--refresh` | - | Force re-download of the remote kubeconfig even if cached. |
| `--kubectl <path>` | `KUBECTL_BIN` | Use a specific kubectl binary instead of auto-detect/install. |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The cache directory stores downloaded kubeconfigs alongside the kubectl binary, which means sensitive credentials persist on disk in a predictable location. Predictable, persistent storage of credential material increases exposure to local compromise, backup retention, or cross-task contamination.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

|------|---------|-------------|
| `--kubeconfig <path>` | `KUBECONFIG_PATH` | Local kubeconfig file path. |
| `--kubeconfig-url <url>` | `KUBECONFIG_URL` | Remote kubeconfig URL (http/https). Downloaded once and cached. |
| `--cache-dir <dir>` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. |
| `--refresh` | - | Force re-download of the remote kubeconfig even if cached. |
| `--kubectl <path>` | `KUBECTL_BIN` | Use a specific kubectl binary instead of auto-detect/install. |
| `--insecure` | - | Pass `-k` to `curl` when downloading the kubeconfig (use only for trusted self-signed endpoints). |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The '--refresh' and '--insecure' options around remote kubeconfig retrieval underscore that the skill may repeatedly fetch sensitive credential material and can do so with TLS verification disabled. Combining credential download with insecure transport meaningfully raises the risk of interception or malicious substitution.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

| `--kubeconfig <path>` | `KUBECONFIG_PATH` | Local kubeconfig file path. |
| `--kubeconfig-url <url>` | `KUBECONFIG_URL` | Remote kubeconfig URL (http/https). Downloaded once and cached. |
| `--cache-dir <dir>` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. |
| `--refresh` | - | Force re-download of the remote kubeconfig even if cached. |
| `--kubectl <path>` | `KUBECTL_BIN` | Use a specific kubectl binary instead of auto-detect/install. |
| `--insecure` | - | Pass `-k` to `curl` when downloading the kubeconfig (use only for trusted self-signed endpoints). |
| `-h`, `--help` | - | Print usage. |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Passing all remaining arguments straight through to kubectl is not itself credential theft, but in combination with kubeconfig handling it enables unrestricted use of whatever privileges the credentials grant. This increases the blast radius of any exposed or over-privileged kubeconfig by allowing arbitrary kubectl subcommands.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

| `--cache-dir <dir>` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. |
| `--refresh` | - | Force re-download of the remote kubeconfig even if cached. |
| `--kubectl <path>` | `KUBECTL_BIN` | Use a specific kubectl binary instead of auto-detect/install. |
| `--insecure` | - | Pass `-k` to `curl` when downloading the kubeconfig (use only for trusted self-signed endpoints). |
| `-h`, `--help` | - | Print usage. |

All other arguments (or anything after `--`) are passed straight through to `kubectl`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The examples section normalizes direct use of local kubeconfigs for potentially sensitive environments such as production. That is a real credential-handling issue because examples influence operator behavior and may encourage using broad, existing credentials rather than scoped ones.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Examples

bash

# List namespaces using a local kubeconfig
bash scripts/k8s.sh --kubeconfig ~/.kube/prod.yaml -- get ns

# Tail logs against a remote kubeconfig

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The transition from local to remote kubeconfig examples demonstrates both credential paths without emphasizing their differing risks. Remote examples are especially sensitive because they add network trust and local persistence concerns on top of credential access.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

bash

# List namespaces using a local kubeconfig
bash scripts/k8s.sh --kubeconfig ~/.kube/prod.yaml -- get ns

# Tail logs against a remote kubeconfig
bash scripts/k8s.sh \