The Agent Skills Directory

[Scoped Command Execution]: The skill uses kubectl and az CLI to interact with the AKS cluster and Azure environment. These commands are used for their intended diagnostic purpose, such as deploying capture Jobs and retrieving effective network rules. User-supplied inputs (like BPF filters and resource names) are validated against strict allowlists before being passed to shell commands, significantly reducing the risk of command injection.
[Trusted Image Sources]: Container images used for packet capture and traffic generation are pulled from the Microsoft Container Registry (MCR). All images are pinned to specific SHA256 digests rather than mutable tags (like :latest), which ensures that only the verified, expected versions of these tools are executed.
[Least Privilege Configuration]: The packet capture Jobs utilize limited Kubernetes security contexts (NET_ADMIN, NET_RAW) and avoid high-privilege settings like hostPID or mounting the node's root filesystem. Captures are bounded by time and stored in a specific host path, with automated cleanup procedures included in the retrieval scripts.
[Azure Resource Collection]: The collect-azure-network-info.sh script gathers configuration metadata (NSGs, routes, load balancers) via the Azure CLI. This is standard diagnostic behavior for identifying network bottlenecks within the Azure fabric.

aks-network-capture