connect-kubernetes-outpost

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPRIVILEGE_ESCALATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references external repositories for downloading deployment assets.
  • Fetches Helm charts from the vendor's official GitHub Pages repository: https://subimagesec.github.io/helm-charts.
  • Pulls Docker images from the GitHub Container Registry: ghcr.io/subimagesec/subimage-outpost.
  • [COMMAND_EXECUTION]: Provides instructions for generating and executing infrastructure management commands.
  • Uses helm to manage Kubernetes releases.
  • Uses docker to pull and run containers.
  • Uses kubectl to inspect cluster resources and logs.
  • Uses aws eks CLI for configuring access entries.
  • [CREDENTIALS_UNSAFE]: The skill handles sensitive Tailscale registration keys (tskey-client-).
  • It identifies these as credentials and provides clear security guidance to avoid leaking them into shell history, recommending the use of values files instead of the --set flag.
  • Advises marking Terraform variables as sensitive.
  • [PRIVILEGE_ESCALATION]: Addresses Kubernetes RBAC configuration.
  • Explains the default permissions (listing secrets) and provides an explicit configuration option (rbac: {secrets: false}) for users to opt out of these elevated permissions if they are not required.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 11:39 PM