CtrlK
BlogDocsLog inGet started
Tessl Logo

pantheon-ai/helm-generator

Comprehensive toolkit for generating best practice Helm charts and resources following current standards and conventions. Use this skill when creating new Helm charts, implementing Helm templates, or building Helm projects from scratch.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files
Low

W011: Third-party content exposure detected (indirect prompt injection risk).

What this means

The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.

Why it was flagged

The SKILL.md Chart Generation Workflow (Stage 2) explicitly requires a fallback "WebSearch" (e.g., searching "<operator> <CRD-kind> <version> kubernetes documentation spec") to fetch public third‑party documentation that the agent is expected to read and use to generate templates, so untrusted web content can directly influence its actions.

Where we found it

WebSearch fallback for Kubernetes CRD documentation

content-type · 2 sites

The SKILL.md explicitly instructs the agent to use WebSearch as a fallback to fetch public third-party Kubernetes documentation for CRD kinds, which the agent then reads and uses to generate Helm chart templates, creating an indirect prompt-injection vector.

SKILL.md

47

2. **Fallback to WebSearch:**

SKILL.md

49

"<operator>" "<CRD-kind>" "<version>" kubernetes documentation spec

context7 MCP

domain · 3 sites

The SKILL.md instructs the agent to use context7 MCP (a third-party Model Context Protocol service) to fetch CRD documentation, which is then used to generate Helm chart templates, creating an indirect prompt-injection vector.

SKILL.md

41

1. **Try context7 MCP first:**

SKILL.md

43

mcp__context7__resolve-library-id with operator name

SKILL.md

44

mcp__context7__get-library-docs with topic for CRD kind

Report incorrect finding
Audited
Security analysis
Snyk