hunt-k8s

Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated nodes/proxy RCE, EphemeralContainers node-shell, bound/projected SA-token audience+expiry abuse, admission-controller bypass, Helm/Tiller remnants. Use when target runs containerized infra, exposes K8s ports (6443/10250/10255/2379/8443), or cloud metadata reveals K8s service accounts.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thoroughly actionable, well-sequenced hunting playbook with strong validation gates suited to its destructive/RCE class. The two softer dimensions are token-efficiency (long but justified by breadth) and progressive disclosure (everything inline, no bundle files to offload the CVE/chain reference material into).

Suggestions

Move the per-CVE catalog (CVE-2018-1002105, CVE-2024-21626, CVE-2025-1974, etc.) and the Chain Table into a references/ file (e.g. CVE_REFERENCE.md) linked from a short summary in the body, improving both conciseness and progressive disclosure.

Tighten the Phase 3 narrative explaining the old plain-POST mistake to a one-line 'NOTE: /exec streams via SPDY/WebSocket; a plain POST returns a 302, not output' so the correction earns its place without prose.

Add a one-line 'Prerequisites / when NOT to run' pointer at the top so operators can short-circuit without scanning all phases.

Dimension	Reasoning	Score
Conciseness	The body assumes Claude's competence — it never explains what Kubernetes, pods, or etcd are — and every section is operational, but at ~290 lines with some narrative prose (e.g., Phase 3's correction of the old plain-POST approach) it is efficient rather than maximally lean.	4 / 5
Actionability	Copy-paste-ready, executable commands throughout — curl/etcdctl/kubectl invocations and python one-liners with shell variables — covering the common cases for each primitive, matching the fully-executable anchor.	5 / 5
Workflow Clarity	Phases 1–8 are explicitly sequenced with strong validation: a dedicated 'OOB / Confirmation Gate (Read First)' section, 'False-Positive Killers', and a 'Validation Checklist' provide explicit checkpoints and feedback loops for this destructive/RCE-class skill.	5 / 5
Progressive Disclosure	Well-organized into clear headers with internal cross-references ('see Phase 3', 'see false-positive section'), but the skill is a monolithic ~290-line file with no bundle files; content like the CVE catalog or chain table could live in separate reference files for cleaner navigation.	4 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, highly specific description that names concrete primitives and an explicit, trigger-rich 'Use when' clause; it covers both what and when with minimal conflict risk. The only soft spot is jargon-heavy phrasing that drops a point on natural trigger-term quality.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete attack primitives — 'API anonymous access', 'kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive', 'etcd 2379 unauth', 'docker.sock host escape', 'runc/container-escape (Leaky Vessels CVE-2024-21626)' — covering the domain comprehensively with no vague filler.	5 / 5
Completeness	Explicitly answers both 'what' (the enumerated hunt primitives) and 'when' via a concrete 'Use when...' clause with specific port/metadata triggers, matching the anchor for clearly answering both.	5 / 5
Trigger Term Quality	The 'Use when' clause names natural triggers a specialist would say — 'target runs containerized infra, exposes K8s ports (6443/10250/10255/2379/8443), or cloud metadata reveals K8s service accounts' — with good coverage of synonyms (Kubernetes/K8s, Docker) and port numbers, but the vector list is jargon-dense and a few lay terms are absent.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (K8s/Docker offensive hunting) with distinct, CVE- and port-specific triggers that are unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-k8s/SKILL.md
Commit: 646b72e

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.