Menu
Reviews Kubernetes manifests for node boundary violations and risks of node-to-cluster privilege escalation.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Autonomously poll, triage, investigate, and resolve unaddressed open issues on our target GitHub repository strictly within authorized scope.
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto Provisioning configuration or general GKE cluster creation.
Audit, monitor, and debug the logging, tracing, metrics, and API/dashboard observability of the Platform Agent.
Standard Operating Procedure (SOP) for generating and updating secure, compliant, and cost-effective GKE manifests.
Systematic Standard Operating Procedure (SOP) for diagnosing GKE workload failures, crash loops, resource OOMs, mounting errors, and connectivity timeouts.
Reviews Kubernetes Pod security contexts for workload-level isolation and privilege escalation risks.
| name | review-security-k8s-nodes |
| description | Reviews Kubernetes manifests for node boundary violations and risks of node-to-cluster privilege escalation. |
Review K8s manifests for node boundary violations allowing compromised nodes/pods to escalate privileges cluster-wide.
hostPath mounts to sensitive node directories (/etc/kubernetes, /var/lib/kubelet, kubeconfig). Recommend VAPs.hostPath mounts to container runtime sockets (e.g., /var/run/docker.sock, containerd.sock). Enables full node takeover.system:nodes or system:node:<name> bypassing NodeRestriction.impersonate on system:nodes.create, update, patch, delete on nodes, nodes/status, etc.). Allows malicious relabeling/scheduling.tolerations (e.g., operator: Exists with no key) on untrusted workloads allowing them to schedule on sensitive nodes (e.g. control-plane).