Security audit
Security checks across malware telemetry and agentic risk
This Kubernetes skill is purpose-aligned but needs Review because it enables broad cluster-changing kubectl access while downloading and caching sensitive kubeconfigs and a kubectl binary with limited guardrails.
Install only if you trust the publisher and intend to let an agent run kubectl against clusters you specify. Prefer a local vetted kubeconfig and a preinstalled official kubectl binary, avoid --insecure except in controlled self-signed environments, review every mutating command before execution, and periodically remove cached kubeconfigs if used.
|------|---------|-------------| | `--kubeconfig <path>` | `KUBECONFIG_PATH` | Local kubeconfig file path. | | `--kubeconfig-url <url>` | `KUBECONFIG_URL` | Remote kubeconfig URL (http/https). Downloaded once and cached. | | `--cache-dir <dir>` | `K8S_SKILL_CACHE_DIR` | Cache directory for downloaded kubeconfigs and kubectl binary. Defaults to `$HOME/.cache/k8s-skill`. | | `--refresh` | - | Force re-download of the remote kubeconfig even if cached. | | `--kubectl <path>` | `KUBECTL_BIN` | Use a specific kubectl binary instead of auto-detect/install. | | `--insecure` | - | Pass `-k` to `curl` when downloading the kubeconfig (use only for trusted self-signed endpoints). |
## Behavior Notes - **kubectl auto-install:** When `kubectl` is missing and no `--kubectl`/`KUBECTL_BIN` override is given, the wrapper downloads a stable `kubectl` binary for the current OS/arch from the DaoCloud mirror (`https://files.m.daocloud.io/dl.k8s.io/...`) and caches it under `<cache-dir>/bin/kubectl`. The cache directory is added to `PATH` for the duration of the command. - **Kubeconfig caching:** Remote kubeconfigs are hashed by URL (sha256) and stored at `<cache-dir>/kubeconfigs/<hash>.yaml`. Use `--refresh` to bypass the cache. - **Secrets:** Downloaded kubeconfigs are written with `chmod 600`. Avoid logging the file contents. - **Cross-platform:** The wrapper auto-detects Linux/macOS and amd64/arm64 for kubectl downloads. - **Errors:** If both kubeconfig sources are missing the script exits with a clear error. Curl/network errors are surfaced verbatim.
## Behavior Notes - **kubectl auto-install:** When `kubectl` is missing and no `--kubectl`/`KUBECTL_BIN` override is given, the wrapper downloads a stable `kubectl` binary for the current OS/arch from the DaoCloud mirror (`https://files.m.daocloud.io/dl.k8s.io/...`) and caches it under `<cache-dir>/bin/kubectl`. The cache directory is added to `PATH` for the duration of the command. - **Kubeconfig caching:** Remote kubeconfigs are hashed by URL (sha256) and stored at `<cache-dir>/kubeconfigs/<hash>.yaml`. Use `--refresh` to bypass the cache. - **Secrets:** Downloaded kubeconfigs are written with `chmod 600`. Avoid logging the file contents. - **Cross-platform:** The wrapper auto-detects Linux/macOS and amd64/arm64 for kubectl downloads. - **Errors:** If both kubeconfig sources are missing the script exits with a clear error. Curl/network errors are surfaced verbatim.
## Behavior Notes - **kubectl auto-install:** When `kubectl` is missing and no `--kubectl`/`KUBECTL_BIN` override is given, the wrapper downloads a stable `kubectl` binary for the current OS/arch from the DaoCloud mirror (`https://files.m.daocloud.io/dl.k8s.io/...`) and caches it under `<cache-dir>/bin/kubectl`. The cache directory is added to `PATH` for the duration of the command. - **Kubeconfig caching:** Remote kubeconfigs are hashed by URL (sha256) and stored at `<cache-dir>/kubeconfigs/<hash>.yaml`. Use `--refresh` to bypass the cache. - **Secrets:** Downloaded kubeconfigs are written with `chmod 600`. Avoid logging the file contents. - **Cross-platform:** The wrapper auto-detects Linux/macOS and amd64/arm64 for kubectl downloads. - **Errors:** If both kubeconfig sources are missing the script exits with a clear error. Curl/network errors are surfaced verbatim.
54/54 vendors flagged this skill as clean.
No suspicious patterns detected.
