Cloud Kubernetes Security
FreeSecure your cloud and Kubernetes environments effectively.
Free · Opens the source repo
What Cloud Kubernetes Security does
The Cloud Kubernetes Security skill is designed for professionals conducting security assessments on cloud, container, and Kubernetes environments. It provides a structured approach to identifying vulnerabilities such as SSRF in cloud metadata, IAM misconfigurations, and potential container escape paths. This skill is essential for security engineers and DevOps professionals who need to ensure that their cloud infrastructure is secure and compliant with best practices.
The workflow is divided into phases, starting with identity and boundary checks to confirm that the assessment is conducted within authorized limits. It emphasizes the importance of avoiding destructive operations and clarifying the scope of the assessment. Users will perform checks on cloud control planes using commands tailored to their cloud provider, such as AWS or Azure, to identify misconfigured IAM roles, public storage buckets, and other security risks.
In the container phase, the skill guides users through assessing container privileges, capabilities, and known vulnerabilities in images. This is crucial for identifying potential escape routes that could be exploited by attackers. The Kubernetes phase focuses on reviewing RBAC settings, secrets management, and network policies to ensure that the cluster is properly secured against unauthorized access.
This skill also includes a toolchain that supports various security assessments, requiring manual installation of tools like kubectl and Trivy for effective operation. It is particularly useful for teams looking to enhance their security posture in cloud-native environments, ensuring that they can proactively identify and mitigate risks before they lead to incidents.
When to use it
Use this skill when conducting authorized security assessments on cloud infrastructure and Kubernetes clusters.
When not to use it
This skill is not suitable for unauthorized scans or assessments outside of defined scopes.
What you can build with it
Assessing IAM Permissions
Use the skill to evaluate IAM permissions and identify any excessive privileges or publicly accessible resources.
Container Vulnerability Scanning
Leverage the skill to scan container images for known vulnerabilities and assess escape paths.
Kubernetes RBAC Review
Conduct a review of Kubernetes RBAC settings to ensure proper access controls are in place.
How to install Cloud Kubernetes Security
View source1. Install with the skills CLI
npx skills add zhaoxuya520/reverse-skill/cloud-k8s --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by zhaoxuya520Cloud / Container / Kubernetes Security
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-pentest.md— 云/K8s 测试必须书面授权NOW: case-init + scope；明确账号边界、禁止破坏性操作NOW: 确认是云元数据/容器/K8s/IAM，而非普通 Web 扫（后者pentest-tools/）NEXT: tool-index；kubectl/aws/gcloud 等多为手动安装ACT: 从「身份与暴露面」开始，禁止默认全网扫描
适用场景
- 云元数据 SSRF（169.254.169.254 / IMDS）
- IAM 过度权限、公开存储桶、错误安全组
- Docker/containerd 逃逸路径评估
- Kubernetes RBAC、Secrets、Admission、供应链镜像
- 容器镜像漏洞（可联动
supply-chain-security/）
工作流
Phase 1 — 身份与边界
□ 当前身份：云 AK/SK、K8s SA、节点 SSH？
□ 范围：单账号 / 单 cluster / 单 namespace
□ 网络档：authorized_target_only
Phase 2 — 云控制面
# 示例（按厂商替换；MUST 在授权账号内）
aws sts get-caller-identity
aws s3 ls
# Azure / GCP 对应 identity 命令
□ 公开桶 / 错误 ACL
□ 元数据：IMDSv1 vs v2；SSRF 链
□ 角色可扮演（PassRole）与横向
Phase 3 — 容器
□ 是否 privileged / hostPath / hostNetwork
□ capabilities（SYS_ADMIN 等）
□ 可写宿主机路径 → 逃逸候选
□ 镜像历史与已知 CVE → Trivy
Phase 4 — Kubernetes
kubectl auth can-i --list
kubectl get pods,secrets,svc -A
kubectl get clusterrolebindings
□ SA token 挂载与权限
□ 危险 admission webhook 缺失
□ etcd / dashboard 暴露
□ 网络策略是否默认放行
工具链
| 工具 | 用途 | 自举 |
|---|---|---|
| kubectl | 集群交互 | 手动 |
| trivy | 镜像/IaC | bootstrap trivy 若可用 |
| kube-bench / kubeaudit | CIS/配置 | 手动 |
| pacu / scoutsuite | 云审计（授权） | 手动 |
| nuclei | 已知云漏洞模板 | bootstrap nmap/nuclei 生态 |
参考
references/k8s-cloud-checklist.md- CTF 对照：
../../CTF-Sandbox-Orchestrator/competition-agent-cloud/ ../supply-chain-security/../pentest-tools/
路由上下文
上游: MASTER R23
下游: 拿到节点 shell → attack-chain / windows-ad；镜像漏洞 → supply-chain
MUST NOT: 未授权扫公有云其他租户
任务完成自检
- 是否限定在授权账号/cluster？
- 发现是否含复现与影响？
- 是否避免破坏性操作？
- 报告 / journal？
Frequently asked questions about Cloud Kubernetes Security
Similar skills
Cloudflare Security Audit
Perform authorized security audits on codebases.
Authenticated Scan with OpenVAS
Perform deep vulnerability scans using OpenVAS with credentials.
Active Directory Penetration Test
Conduct focused AD penetration tests with ease.
Active Directory BloodHound Analysis
Visualize Active Directory attack paths and risks.
Orchestrating LLM Attacks with PyRIT
Automate multi-turn adversarial attacks against LLMs.
Operating Sliver C2
Deploy and manage Sliver C2 for red-team engagements.