ClawHub
Back to skill

Security audit

k8s-aiops

Security checks across malware telemetry and agentic risk

Overview

This Kubernetes operations skill is coherent and transparent, but it exposes high-impact cluster write actions without an in-skill read-only mode or approval gate.

Install only with a kubeconfig or ServiceAccount scoped to the exact cluster, namespace, and verbs you want the agent to use. For observation-only use, provide read-only RBAC so write attempts fail at the Kubernetes API server. Be especially careful with production contexts, namespace deletion, deployment/job deletion, rollout undo, set-image, and node drain. Treat ConfigMap values as potentially sensitive even though Kubernetes Secrets are documented as names/keys only.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The capabilities explicitly state that `configmap_get` returns 'keys + values', which can expose sensitive configuration data to the agent or user. While ConfigMaps are not intended for secrets, they commonly contain internal endpoints, tokens mistakenly stored as plaintext, feature flags, or other operationally sensitive data; in a Kubernetes operations skill, broad read access makes this materially risky.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The kubeconfig context you connect with.** Bind it to a ServiceAccount or
Confidence
95% confidence
Finding
The document explicitly states the tool has no read-only switch and no approval prompt, meaning write operations are not constrained by the skill itself. In an agentic setting, relying only on external RBAC or prompting increases the chance that a misconfigured kubeconfig or an over-permissioned account will allow unintended destructive cluster actions.

Credential Access

High
Category
Privilege Escalation
Content
- Undo store records inverse descriptors for reversible writes (scale → previous replicas; cordon ↔ uncordon)
- Each write carries a descriptive risk-tier label into its audit row — a label, not a gate; `K8S_AUDIT_APPROVED_BY` / `K8S_AUDIT_RATIONALE` are optional annotations recorded when set, never required

**Authorization is not this tool's job.** There is no read-only switch, policy file, or approval gate. Whether a write is permitted is the agent's judgement or the RBAC of the kubeconfig context you connect with — give it a read-only ServiceAccount and writes fail at the apiserver, the place that owns the permission.

The harness is bundled in the package — no external dependency, no manual setup. See `references/setup-guide.md` for security details.
Confidence
87% confidence
Finding
This skill explicitly states there is no read-only switch, policy file, or approval gate, and that write permission is left to agent judgment or whatever RBAC the kubeconfig grants. In an agent-executed environment, that creates a genuine risk of destructive cluster actions if the runtime is configured with broad credentials, because the skill exposes delete, drain, rollout undo, scaling, image change, and namespace operations without an internal authorization control.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agent-guardrails.md:42