hunt-k8s
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses various standard tools including curl, nmap, etcdctl, and kubectl to audit Kubernetes and Docker environments. These operations are within the expected scope of a security auditing skill.
- [REMOTE_CODE_EXECUTION]: Automated scans flagged patterns of piping curl output to python3. Detailed inspection confirms these are safe usage patterns: 'python3 -m json.tool' is used to format JSON output for readability, and 'python3 -c' is used with hardcoded scripts to count elements in JSON responses. The remote content is processed as data, not executed as code.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Kubernetes API endpoints (e.g., /pods, /secrets). While this data is untrusted, it is handled as structured JSON and used for auditing purposes without being passed to shells or dynamic execution sinks.
Audit Metadata