k8s-catch-up
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The maintainer script
scripts/k8s-features.pyuses thesubprocess.runfunction to executegitcommands. These commands are used to clone and synchronize Kubernetes enhancement and website data. The script correctly uses list-based arguments for command execution without invoking a shell.\n- [EXTERNAL_DOWNLOADS]: The maintenance script fetches documentation and feature metadata from the official Kubernetes project repositories on GitHub. These are recognized as trusted, well-known sources used for the intended purpose of updating the skill's reference content.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes a large set of reference markdown files describing Kubernetes features to assist in manifest generation.\n - Ingestion points: Markdown files located in the
references/directory.\n - Boundary markers: The
SKILL.mdprovides guidance on how to interpret and present the information, including instructions to check version compatibility and feature stages.\n - Capability inventory: The agent generates Kubernetes YAML manifests and
kubectlCLI commands based on the provided reference content.\n - Sanitization: The reference data consists of static content curated within the skill's repository.
Audit Metadata