The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of curl, nmap, and etcdctl to interact with Kubernetes infrastructure. These are the primary tools for the skill's stated purpose of security auditing.
[REMOTE_CODE_EXECUTION]: Automated scans flagged patterns like curl -s "http://$TARGET:10255/pods" | python3. While this technically pipes network data to an interpreter, in this context, it is used for local JSON formatting (python3 -m json.tool) of publicly exposed read-only endpoints, not for executing remote scripts.
[EXTERNAL_DOWNLOADS]: The skill mentions external tools like kubeletctl, websocat, and wscat. These are standard third-party security tools recommended for handling specific protocols like SPDY and WebSockets in Kubernetes clusters.
[DATA_EXFILTRATION]: The skill includes instructions to read sensitive files like ServiceAccount tokens and /etc/hostname. These actions are performed to demonstrate 'impact' during a security audit and are directed to the user's terminal, not an external attacker-controlled server.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data from remote Kubernetes APIs. It uses structured parsing (via python3 -m json.tool or grep) which provides a boundary between the untrusted data and the execution context, minimizing injection risk.

hunt-k8s