container-audit

Audit container images, Dockerfiles, and Kubernetes manifests for misconfigurations, excessive privileges, exposed secrets, and runtime risks. Use when the user mentions 'container security,' 'Docker security,' 'Dockerfile audit,' 'Kubernetes security,' 'K8s security,' 'pod security,' 'container hardening,' 'kubectl audit,' 'image scanning,' 'distroless,' 'rootless containers,' 'pod security policy,' 'pod security standards,' 'PSS,' 'network policy,' 'OPA Gatekeeper,' 'Kyverno,' 'runtime security,' or needs to review container or orchestration security.

Quality

98%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, highly actionable audit checklist with executable commands, grep patterns, a clear workflow including runtime verification, and a report template. Its only gap is progressive disclosure: everything lives in one monolithic file with no referenced bundle files.

Suggestions

Move the per-category checklists (Dockerfile, Kubernetes, runtime) or the report-format template into reference files under references/ and link to them from SKILL.md, so the main file is a leaner overview with one-level-deep references.

Consider extracting the 'Useful one-liners' into a references/one-liners.md or scripts/ helper, keeping only the most essential commands inline.

If the checklists grow further, split the Kubernetes section (pod security, network, secrets, RBAC, resource limits, image policy) into a dedicated reference to keep SKILL.md scannable.

Dimension	Reasoning	Score
Conciseness	Dense actionable checklist with grep patterns and one-liners that assumes Claude's competence; explanatory asides ('K8s Secrets are base64-encoded, NOT encrypted') are domain-specific value-adds, not basic-concept padding; not 4 because there is little that could be trimmed without losing useful guidance.	5 / 5
Actionability	Copy-paste-ready bash one-liners, executable trivy/kubectl/kube-bench commands, concrete grep patterns, and a filled-in report template cover the common audit cases; not 4 because guidance is fully executable rather than mostly executable with gaps.	5 / 5
Workflow Clarity	Clear Scope → Audit (by category) → Verify Fixes at Runtime → Report sequence with extensive checklists and an explicit verification section; the audit is read-only with validation present, so the destructive/batch cap does not apply; not 4 because explicit validation steps and checklists are present.	5 / 5
Progressive Disclosure	Well-organized section headers give good structure, but it is a single ~190-line monolithic file with no bundle files and no external references; the 5 anchor requires well-signaled one-level-deep references and content appropriately split, which are absent, so it sits above the 3 anchor at 4.	4 / 5
	Total	19 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: third-person voice, concrete multi-target actions, an explicit 'Use when' clause, and a deep set of natural trigger terms with synonyms. It cleanly distinguishes its niche from neighboring audit skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete audit actions ('misconfigurations, excessive privileges, exposed secrets, and runtime risks') across three concrete targets (container images, Dockerfiles, Kubernetes manifests), matching the comprehensive-coverage anchor; not 4 because coverage has no real gaps.	5 / 5
Completeness	Explicitly answers both 'what' (audit containers/Dockerfiles/K8s manifests for the listed risks) and 'when' via a concrete 'Use when the user mentions...' clause with many trigger phrases; not 4 because 'when' is fully explicit and specific.	5 / 5
Trigger Term Quality	Comprehensive natural trigger terms with synonyms and abbreviations ('container security,' 'Docker security,' 'K8s security,' 'pod security,' 'distroless,' 'rootless containers,' 'PSS,' 'OPA Gatekeeper,' 'Kyverno,' 'runtime security'); not 4 because common variations are thoroughly covered.	5 / 5
Distinctiveness Conflict Risk	Clear container/orchestration niche with distinct triggers and minimal overlap; the body further distinguishes it from cloud-audit and dependency-audit, matching the clear-niche anchor; not 4 because conflict risk is minimal rather than just 'mostly distinct.'	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning

	Total	15 / 16 Passed

Repository: briiirussell/cybersecurity-skills
Path: skills/container-audit/SKILL.md
Commit: c9ade03

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.