用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill k8s-assessment命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | k8s-assessment |
| description | READ-ONLY Kubernetes security assessment based on CIS Kubernetes Benchmark using kubectl |
| category | security-assessment |
| tags | ["kubernetes","k8s","cis-benchmark","rbac","network-policy","pod-security","secrets","ingress","security-audit"] |
| tech_stack | ["kubernetes","kubectl"] |
| cwe_ids | ["CWE-269","CWE-284","CWE-311","CWE-732","CWE-693"] |
| chains_with | ["T1613","T1087.004","T1078.004"] |
| prerequisites | ["kubectl-access"] |
| version | 1.0 |
READ-ONLY Kubernetes security assessment using kubectl CLI. No resources are created, modified, or deleted — all checks use get/list/describe/auth can-i verbs only. Based on CIS Kubernetes Benchmark v1.8+.
kubectl version --clientk8s_audit verify_readonly first# Quick prerequisite check
kubectl version --client # verify kubectl
kubectl cluster-info # verify cluster access
kubectl auth can-i list pods --all-namespaces # verify read access
k8s_audit verify_readonly
Confirms current identity has no write/modify/delete permissions via kubectl auth can-i. If write permissions are detected, STOP and request a read-only kubeconfig.
| Check | Command | CIS Benchmark |
|---|---|---|
| cluster-admin bindings | k8s_audit rbac_audit | 5.1.1 |
| Wildcard ClusterRoles | k8s_audit rbac_audit | 5.1.3 |
| Default SA permissions | k8s_audit rbac_audit --namespace NS | 5.1.5 |
| Check | Command | CIS Benchmark |
|---|---|---|
| Privileged containers | k8s_audit pod_security_audit | 5.2.1 |
| hostPID / hostNetwork | k8s_audit pod_security_audit | 5.2.2, 5.2.3 |
| Dangerous capabilities | k8s_audit pod_security_audit | 5.2.7-9 |
| Root execution | k8s_audit pod_security_audit | 5.2.6 |
| hostPath mounts |
k8s_audit pod_security_audit |
| 5.2.13 |
| Check | Command | CIS Benchmark |
|---|---|---|
| Missing NetworkPolicies | k8s_audit network_policy_audit | 5.3.2 |
| Default deny policies | k8s_audit network_policy_audit | 5.3.2 |
| Ingress TLS | k8s_audit ingress_audit | — |
| Ingress snippet injection | k8s_audit ingress_audit | — |
| Check | Command | CIS Benchmark |
|---|---|---|
| Secret types & counts | k8s_audit secrets_audit | 5.4.1 |
| Secrets as env vars | k8s_audit secrets_audit | 5.4.1 |
| etcd encryption | k8s_audit secrets_audit | 1.2.29-30 |
| Check | Command | CIS Benchmark |
|---|---|---|
| Anonymous auth | k8s_audit api_server_audit | 1.2.1 |
| Insecure port | k8s_audit api_server_audit | 1.2.19 |
| Admission controllers | k8s_audit api_server_audit | 1.2.11-16 |
| Audit logging | k8s_audit api_server_audit | 1.2.17-18 |
| Check | Command | CIS Benchmark |
|---|---|---|
| Resource limits | k8s_audit resource_limits_audit | 5.4.1 |
| LimitRange/ResourceQuota | k8s_audit resource_limits_audit | — |
| Image tags | k8s_audit image_audit | — |
| Untrusted registries | k8s_audit image_audit | — |
| SA auto-mount tokens | k8s_audit serviceaccount_audit | 5.1.5-6 |
| Program | Checks | CIS Section |
|---|---|---|
| verify_readonly | Write permission detection | — |
| rbac_audit | cluster-admin, wildcards, default SA | 5.1.x |
| network_policy_audit | Missing policies, default deny | 5.3.x |
| pod_security_audit | Privileged, hostPID, capabilities, root | 5.2.x |
| secrets_audit | Secret types, env exposure, etcd encryption | 1.2.29, 5.4.x |
| image_audit | Latest tags, pull policy, untrusted registries | — |
| api_server_audit | Anonymous auth, insecure port, admission, audit | 1.2.x |
| resource_limits_audit | CPU/memory limits, LimitRange, ResourceQuota | 5.4.x |
| ingress_audit | TLS, wildcard hosts, snippet injection | — |
| serviceaccount_audit | Auto-mount tokens, cluster-admin SAs, unused SAs | 5.1.x |