connect-kubernetes-outpost
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external repositories for downloading deployment assets.
- Fetches Helm charts from the vendor's official GitHub Pages repository:
https://subimagesec.github.io/helm-charts. - Pulls Docker images from the GitHub Container Registry:
ghcr.io/subimagesec/subimage-outpost. - [COMMAND_EXECUTION]: Provides instructions for generating and executing infrastructure management commands.
- Uses
helmto manage Kubernetes releases. - Uses
dockerto pull and run containers. - Uses
kubectlto inspect cluster resources and logs. - Uses
aws eksCLI for configuring access entries. - [CREDENTIALS_UNSAFE]: The skill handles sensitive Tailscale registration keys (
tskey-client-). - It identifies these as credentials and provides clear security guidance to avoid leaking them into shell history, recommending the use of values files instead of the
--setflag. - Advises marking Terraform variables as
sensitive. - [PRIVILEGE_ESCALATION]: Addresses Kubernetes RBAC configuration.
- Explains the default permissions (listing secrets) and provides an explicit configuration option (
rbac: {secrets: false}) for users to opt out of these elevated permissions if they are not required.
Audit Metadata