القائمة
Reviews Kubernetes Pod security contexts for workload-level isolation and privilege escalation risks.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Autonomously poll, triage, investigate, and resolve unaddressed open issues on our target GitHub repository strictly within authorized scope.
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto Provisioning configuration or general GKE cluster creation.
Audit, monitor, and debug the logging, tracing, metrics, and API/dashboard observability of the Platform Agent.
Standard Operating Procedure (SOP) for generating and updating secure, compliant, and cost-effective GKE manifests.
Systematic Standard Operating Procedure (SOP) for diagnosing GKE workload failures, crash loops, resource OOMs, mounting errors, and connectivity timeouts.
Propose declarative configuration updates securely by committing file changes and submitting GitHub Pull Requests (PRs) for SRE review.
| name | review-security-k8s-pod |
| description | Reviews Kubernetes Pod security contexts for workload-level isolation and privilege escalation risks. |
Review Pod configurations (PodSecurityContext, SecurityContext) for workload vulnerabilities.
privileged: true.hostNetwork: true, hostPID: true, hostIPC: true. If runAsUser: 0 or runAsGroup: 0, flag hostUsers: true and flag omitted hostUsers (since it's true by default).hostPath volumes (direct node filesystem access).allowPrivilegeEscalation: false.hostUsers: false or if hostUsers is omitted, require runAsNonRoot: true. Flag runAsUser: 0 or runAsGroup: 0.capabilities.drop: ["ALL"]. Flag highly privileged additions (e.g., CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_SYS_MODULE, CAP_SYS_PTRACE, CAP_DAC_OVERRIDE).readOnlyRootFilesystem: true where applicable.seccompProfile.type: RuntimeDefault).default service account.automountServiceAccountToken: false unless API access is explicitly needed.TokenRequest volume mounts.@sha256:...) instead of mutable tags.