CtrlK
BlogDocsLog inGet started
Tessl Logo

k8s-rbac-abuse

Kubernetes RBAC privilege escalation paths — ClusterRole/Role enumeration via `kubectl auth can-i --list`, abuse of pods/exec, pods/portforward, secrets get, escalate verb, bind verb, impersonate verb, system:masters group abuse, ServiceAccount token theft and reuse.

68

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an efficient, highly actionable playbook with clear phasing and permission-gated decision branches. Its main gap is the absence of an explicit verification checkpoint confirming escalation succeeded after each destructive path.

Suggestions

Add an explicit verification step after each escalation path (e.g., re-run `kubectl auth can-i '*' '*' --all-namespaces` to confirm cluster-admin was achieved before proceeding).

Separate external resource links from cross-references to other skills in the References section so navigation is clearer.

Consider extracting the long Phase 2 escalation path catalog into a reference file to keep SKILL.md as a tighter overview.

DimensionReasoningScore

Conciseness

Lean and command-driven; it assumes Claude's knowledge of Kubernetes and RBAC and never pads with background explanations, so every line earns its place.

5 / 5

Actionability

Fully executable, copy-paste-ready kubectl commands cover each escalation path, with concrete jq filters and pod manifests for the common cases.

5 / 5

Workflow Clarity

Clear phased sequence (enumerate → escalate → persist) with `kubectl auth can-i` permission gates acting as checkpoints, but it lacks an explicit post-escalation verification step (e.g., confirm cluster-admin) after the destructive paths.

4 / 5

Progressive Disclosure

Well-organized into clear phases and sections with no bundle files to navigate, though the trailing References section mixes external links and skill cross-references without tight signaling.

4 / 5

Total

18

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and distinctive with strong trigger terms, but lacks an explicit 'when to use' clause, leaving the completeness dimension capped. Adding a 'Use when...' sentence would lift it into the top tier.

Suggestions

Add an explicit 'Use when...' clause stating when Claude should invoke this skill (e.g., 'Use when assessing Kubernetes RBAC privilege-escalation paths from a compromised ServiceAccount token').

Include a few more natural synonyms or phrasings users might say (e.g., 'k8s', 'cluster-admin', 'role escalation') to broaden trigger coverage.

Keep the concrete verb/path list but consider tightening it slightly so the description stays scannable.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — enumeration via `kubectl auth can-i --list`, abuse of pods/exec, pods/portforward, secrets get, escalate/bind/impersonate verbs, system:masters abuse, and ServiceAccount token theft — giving comprehensive coverage of the skill's capabilities.

5 / 5

Completeness

The 'what' is explicit and detailed, but there is no 'Use when...' clause or equivalent trigger guidance in the description itself, capping completeness at 3 per the rubric guideline.

3 / 5

Trigger Term Quality

Strong natural terms a practitioner would say ('Kubernetes RBAC', 'privilege escalation', 'pods/exec', 'secrets', 'ServiceAccount token theft'), though a few common phrasings and synonyms are absent.

4 / 5

Distinctiveness Conflict Risk

A sharply defined niche (Kubernetes RBAC privilege escalation) with distinct, specific triggers and minimal overlap risk with other skills.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.