kubernetes-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The playbook explicitly instructs reading service-account tokens, cloud metadata credentials, etcd/docker secrets and then printing or embedding them in commands/headers (e.g., Authorization: Bearer $TOKEN, decoding dockerconfigjson, dumping IMDS creds), which requires handling and outputting secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive playbook for compromising Kubernetes environments, containing multiple high-risk instructions for credential theft, secret exfiltration, privilege escalation, remote code execution, and C2/backdoor use.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs creating privileged pods, mounting hostPath/root, placing manifests under /etc/kubernetes/manifests, and accessing master certs/ kubeconfigs — all actions that modify node/cluster state and require elevated privileges, so it pushes the agent to compromise the machine.