菜单
Reviews Kubernetes RBAC configurations for permissions and privilege escalation risks.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Autonomously poll, triage, investigate, and resolve unaddressed open issues on our target GitHub repository strictly within authorized scope.
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto Provisioning configuration or general GKE cluster creation.
Audit, monitor, and debug the logging, tracing, metrics, and API/dashboard observability of the Platform Agent.
Standard Operating Procedure (SOP) for generating and updating secure, compliant, and cost-effective GKE manifests.
Systematic Standard Operating Procedure (SOP) for diagnosing GKE workload failures, crash loops, resource OOMs, mounting errors, and connectivity timeouts.
Reviews Kubernetes Pod security contexts for workload-level isolation and privilege escalation risks.
| name | review-security-k8s-rbac |
| description | Reviews Kubernetes RBAC configurations for permissions and privilege escalation risks. |
Review Kubernetes RBAC configurations for vulnerabilities, prioritizing GKE best practices and advanced attack vectors.
system:anonymous, system:unauthenticated, system:authenticated, system:masters.system:serviceaccounts or system:serviceaccounts:<namespace>.cluster-admin bindings to unauthenticated/broad groups.delete/update on system: prefixed bindings.ClusterRoleBindings to ServiceAccount missing a namespace.bind, escalate, create, update, patch on rbac.authorization.k8s.io. Flag create on certificatesigningrequests or update on certificatesigningrequests/approval.create, update, patch on mutatingwebhookconfigurations, validatingwebhookconfigurations, or customresourcedefinitions.create on tokenreviews/subjectaccessreviews.update/patch on namespaces (PSA bypass) or modification access to networkpolicies.* in apiGroups, resources, verbs. Flag deletecollection (DoS risk).escalate, bind, impersonate.ClusterRoleBindings used where namespace-local RoleBindings suffice. Flag disjoint resource/verb sets in single roles.secrets, pods/exec, pods/portforward, pods/attach, nodes/proxy (unless strictly scoped via resourceNames).list or watch on secrets.update/patch on pods/ephemeralcontainers or /status subresources.resources/gke-rbac.md for additional guidance. Identify if any of this guidance is both relevant and missing from your review and include those findings as well.