analyzing-kubernetes-audit-logs

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-kubernetes-audit-logs/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-sectioned, but it under-uses its own bundle: a full analyzer script and an API reference exist yet are never linked, detection logic is shown for only one of five event types, and the "Examples" snippet is not self-contained. Workflow sequencing and validation checkpoints are missing.

Suggestions

Reference scripts/agent.py and references/api-reference.md from the body (e.g., "For a complete analyzer, run scripts/agent.py --audit-log ...; see references/api-reference.md for the event schema and audit policy levels") so the bundle is discoverable.

Make the "Examples" snippet self-contained or replace it with a call to the bundled analyzer covering all five event types, since the current fragment reuses undefined verb/user/event variables.

Add an explicit numbered workflow (parse -> detect -> report) with a validation/checkpoint step, e.g. confirming the report file was written and contains findings, to raise workflow clarity.

Dimension	Reasoning	Score
Conciseness	The body is lean with no concept padding, but the "Key events to detect" list overlaps the description and the Examples fragment duplicates variables from the first block, so it is not a clean score-5.	4 / 5
Actionability	The first code block is executable and covers pod exec, but the other four event types are only listed without detection logic, the "Examples" snippet references undefined variables (verb/user/event) so it is not copy-paste ready, and the complete scripts/agent.py analyzer is never referenced.	3 / 5
Workflow Clarity	There is no explicit sequenced workflow (parse -> detect -> report) with checkpoints; the body presents a code snippet plus a list rather than ordered steps, and output validation is absent.	3 / 5
Progressive Disclosure	Sections are present and organized, but the body never signals the existing bundle files (references/api-reference.md, scripts/agent.py), and the audit-log format content that lives in api-reference.md is partially re-inlined instead of referenced.	3 / 5
	Total	13 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states capabilities, provides explicit "Use when" triggers, lists natural keywords, and disambiguates against a sibling skill. The only blemish is a stray trailing quote artifact in the YAML, which is a parsing issue rather than a content-quality issue.

Dimension	Reasoning	Score
Specificity	"Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules" lists multiple concrete actions with comprehensive coverage, matching the score-5 anchor.	5 / 5
Completeness	It explicitly answers "what" (parse/detect/build SIEM rules) and "when" ("Use when investigating a suspected cluster compromise, reconstructing what an attacker did...or writing Kubernetes-specific detection content") with concrete trigger phrases.	5 / 5
Trigger Term Quality	An explicit "Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules" list plus natural "Use when" phrasings gives comprehensive coverage of terms a user would actually say.	5 / 5
Distinctiveness Conflict Risk	Clear niche (Kubernetes API audit logs) with an explicit disambiguation boundary ("Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco"), minimizing conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-kubernetes-audit-logs/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.