kubernetes-operations
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided Kubernetes manifests and Helm charts, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads and analyzes
.yamland.ymlfiles through the includedscripts/validate-k8s-manifest.shandscripts/security-scan-k8s.shscripts. - Boundary markers: While the skill enforces a structured 'Output Contract' for agent responses, it does not implement explicit delimiters or warnings to ignore instructions that might be embedded within the Kubernetes manifest metadata or comments.
- Capability inventory: The skill allows the agent to generate new manifests, read local files, and suggest CLI commands for cluster management (
kubectl,helm,flux,argocd). - Sanitization: Risks are partially mitigated by the requirement to validate manifests against official JSON schemas and run security scans (e.g., checking for privileged containers or hostPath mounts).
- [EXTERNAL_DOWNLOADS]: The
scripts/validate-k8s-manifest.shscript references and downloads Kubernetes JSON schemas fromraw.githubusercontent.com(a well-known service) for validation purposes. These downloads are legitimate operational requirements and do not involve the execution of remote code.
Audit Metadata