菜单
Binary Kubernetes securityContext hardening check. Use when reviewing Pods, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Helm templates, or Kubernetes manifests that define containers. Minimal output only: OK or NOT_OK: RULE, RULE.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Full project security audit. Scans the entire codebase across three passes: code that shouldn't exist, all dependencies assessed, all hardening findings. Produces a comprehensive numbered report with blast-radius narrative. For per-diff review use ponytail-sec instead.
Security companion for active development. Scopes to the current diff or changed files. Three passes: YAGNI code review, new-dep assessment, and up to 3 material hardening findings. Lean by design — surfaces the one thing to fix before merging, not a backlog. Use ponytail-sec-audit for a full project scan.
Binary Dockerfile image-build hardening check. Use when reviewing Dockerfiles, container image builds, multi-stage builds, runtime users, pinned bases, or reproducible dependency installs. Minimal output only: OK or NOT_OK: RULE, RULE.
基于 SOC 职业分类
| name | k8s-securitycontext |
| description | Binary Kubernetes securityContext hardening check. Use when reviewing Pods, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Helm templates, or Kubernetes manifests that define containers. Minimal output only: OK or NOT_OK: RULE, RULE. |
| license | MIT |
Ask once before enforcing:
Enforce k8s-securitycontext skill? (yes / no)
If no: stop.
If yes: inspect locally first. Do not web-search by default. Web-search only if Kubernetes securityContext semantics are missing or ambiguous, and prefer the official Kubernetes docs.
Return exactly one line:
OKNOT_OK: RULE, RULENo severity. No advisory text. No maybes. If a rule cannot be verified, it is not OK.
All rules are mandatory for every application container. Apply to init and ephemeral containers when present too.
SC_NON_ROOT — require runAsNonRoot: true and no explicit root user
(runAsUser: 0 is not OK).SC_NO_PRIV_ESC — require allowPrivilegeEscalation: false.SC_DROP_CAPS — require capabilities.drop: ["ALL"]; adding capabilities is
not OK unless the manifest proves the workload needs them.SC_SEC_PROFILE — require seccompProfile.type: RuntimeDefault or a stricter
local profile.SC_READ_ONLY_FS — require readOnlyRootFilesystem: true.SC_SELINUX_TYPE — when the workload targets an SELinux-enforcing node class,
OpenShift, SELinux-labeled volumes, or policy says SELinux is required,
require seLinuxOptions.type. Missing type is not OK.OK
NOT_OK: SC_NON_ROOT, SC_NO_PRIV_ESC, SC_SELINUX_TYPE