k8s-kaniko-job
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external commands (
kubectl,tar) to manage Kubernetes resources and archive build contexts. Analysis shows these commands are executed using list-based arguments without shell invocation, preventing command injection vulnerabilities. - [CREDENTIALS_SAFE]: The
kaniko-build.pyscript handles sensitive information likeGITHUB_TOKENand S3 credentials. It includes explicit functions to redact these secrets from diagnostic outputs and ensures they are stored securely as Kubernetes Secret objects rather than passed as insecure build arguments. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the project workspace (source code and configuration files). It mitigates injection risks by validating input parameters (such as build arguments) and using proper YAML quoting when generating Kubernetes manifests.
- [REMOTE_CODE_EXECUTION]: While the skill uses the Kaniko executor image (
gcr.io/kaniko-project/executor), this is a standard industry tool for building images in unprivileged environments and is referenced by a specific version tag.
Audit Metadata