The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Tetragon CLI ('tetra') binary directly from the official Cilium GitHub release page. This is a well-known and reputable source for Kubernetes security tooling and does not represent a security risk.
[COMMAND_EXECUTION]: The provided Python scripts ('agent.py' and 'process.py') execute 'kubectl' and 'tetra' commands using the 'subprocess' module to audit the cluster's security posture and retrieve policy information. These operations are performed using structured command lists rather than raw shell strings, which is a secure practice to prevent command injection.
[PRIVILEGE_ESCALATION]: The documentation includes instructions to use 'sudo install' for placing the Tetragon CLI in a global binary directory ('/usr/local/bin/'). This is a standard administrative task for installing management tools on Linux systems and is consistent with the skill's purpose.
[INDIRECT_PROMPT_INJECTION]: The log analysis script ('process.py') processes external event data, representing a potential attack surface if malicious log content were supplied.
Ingestion points: Event data read from user-provided JSON log files in 'scripts/process.py' via the 'parse_tetragon_events' function.
Boundary markers: No specific delimiters or instruction-ignore markers are present in the log parsing logic.
Capability inventory: The script is primarily diagnostic, using 'subprocess.run' only for 'kubectl' status and policy checks.
Sanitization: The script uses standard 'json.loads' to parse structured event data, extracting only expected fields.

implementing-runtime-security-with-tetragon