The Agent Skills Directory

Command Execution: The skill executes several command-line tools including kubectl and az to manage Kubernetes resources and retrieve Azure configuration. These are used to create Jobs, retrieve pod information, and query network resource metadata.
Sensitive Data Collection: The primary function is to collect packet captures (pcap files) and Azure network resource information. Packet captures can contain sensitive information, such as authentication headers or customer data. The skill includes a dedicated authorization reference (references/capture-authorization.md) to ensure the operator obtains consent before proceeding.
Privilege Escalation Considerations: The packet capture Jobs utilize sensitive Kubernetes configurations, including hostNetwork: true, NET_ADMIN and NET_RAW capabilities, and hostPath volume mounts. These are necessary for performing low-level network captures on AKS nodes.
External Resource Usage: The scripts pull container images from the Microsoft Container Registry (mcr.microsoft.com). These images are pinned by their SHA256 digests, ensuring the integrity of the capture environment.
Input Validation: The scripts implement validation for user-provided parameters, such as node names, namespaces, and BPF filters, using regular expressions to reduce the risk of command injection or malformed resource creation.

aks-network-capture