skills/mukul975/anthropic-cybersecurity-skills/scanning-kubernetes-manifests-with-kubesec/Gen Agent Trust Hub
scanning-kubernetes-manifests-with-kubesec
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Kubesec binary from a remote GitHub repository (controlplaneio/kubesec) and interacts with a public API (v2.kubesec.io) for manifest analysis. These resources are official components of the well-known Kubesec tool suite.
- [COMMAND_EXECUTION]: The scripts/agent.py and scripts/process.py files use the subprocess module to execute system commands, including 'kubesec scan' and 'curl'. These calls are implemented using argument lists rather than shell strings, which provides protection against command injection.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external Kubernetes manifest files to generate security reports. This represents a vulnerability surface for processing untrusted data.
- Ingestion points: scan_manifest in scripts/agent.py and scan_manifest_with_kubesec in scripts/process.py, which read manifest file content from the filesystem.
- Boundary markers: No specific boundary markers or 'ignore embedded instructions' warnings are present in the manifest processing logic.
- Capability inventory: File system read access, network access via the requests library and curl command, and local binary execution via subprocess.
- Sanitization: The scripts use JSON parsing for responses and list-based argument passing for subprocess calls, but do not perform deep sanitization of the manifest content itself.
Audit Metadata