auditing-kubernetes-cluster-rbac
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.
78
73%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/auditing-kubernetes-cluster-rbac/SKILL.mdQuality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong, highly specific description that clearly defines the domain (Kubernetes RBAC auditing), lists concrete actions (identifying overly permissive roles, wildcard permissions, privilege escalation paths), and names specific tools. Its main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know exactly when to select this skill over others.
Suggestions
Add a 'Use when...' clause, e.g., 'Use when the user asks about Kubernetes RBAC security, auditing cluster permissions, reviewing role bindings, or checking for privilege escalation risks.'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: identifying overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths. Also names specific tools: kubectl, rbac-tool, KubiScan, and Kubeaudit. | 3 / 3 |
Completeness | The 'what' is thoroughly covered with specific actions and tools, but there is no explicit 'Use when...' clause or equivalent trigger guidance telling Claude when to select this skill. Per the rubric, a missing 'Use when...' clause caps completeness at 2. | 2 / 3 |
Trigger Term Quality | Excellent coverage of natural terms a user would use: 'Kubernetes', 'RBAC', 'cluster', 'permissions', 'ClusterRoleBindings', 'service account', 'privilege escalation', 'kubectl', plus specific tool names like 'KubiScan' and 'Kubeaudit' that users familiar with the domain would reference. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche: Kubernetes RBAC auditing with specific tools and specific security concerns. Very unlikely to conflict with other skills given the narrow, well-defined domain. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
64%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a highly actionable skill with excellent executable code examples covering multiple tools and attack surfaces for Kubernetes RBAC auditing. Its main weaknesses are verbosity (explaining concepts Claude already knows, like RBAC definitions), lack of validation checkpoints between workflow steps, and monolithic structure that could benefit from splitting detailed tool references and remediation guidance into separate files.
Suggestions
Remove the 'Key Concepts' table — Claude already knows what RBAC, ClusterRoles, and service accounts are. If any term is truly novel, define it inline where first used.
Add explicit validation checkpoints between steps, e.g., 'Before proceeding to Step 3, verify Step 1-2 findings are consistent — if no custom ClusterRoles found, check kubectl context is correct' and a final verification step after remediation.
Split the detailed per-tool command references (Steps 3-6) into a separate TOOLS_REFERENCE.md and keep SKILL.md as an overview with the most critical commands inline.
Add error handling guidance — what to do when rbac-tool or KubiScan returns no results (could indicate permission issues), or when kubectl commands fail due to insufficient RBAC permissions for the auditor.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is quite long (~250 lines) with some redundancy. The 'Key Concepts' table explains RBAC, ClusterRole, and ClusterRoleBinding definitions that Claude already knows. The 'When to Use' and 'Do not use' sections add moderate value but are somewhat verbose. However, the code blocks themselves are efficient and purposeful. | 2 / 3 |
Actionability | Excellent actionability throughout. Every step contains fully executable bash commands and Python scripts that can be copy-pasted directly. The kubectl queries, rbac-tool commands, KubiScan invocations, and Kubeaudit commands are all concrete and specific with real flags and output processing. | 3 / 3 |
Workflow Clarity | The 6-step workflow is clearly sequenced and logically ordered from enumeration through tool-based scanning. However, there are no explicit validation checkpoints or feedback loops between steps — no 'verify your findings before proceeding' gates, no error recovery guidance if tools fail or return unexpected results, and no verification step at the end to confirm remediation was effective. | 2 / 3 |
Progressive Disclosure | The content is entirely monolithic — everything is in a single file with no references to external documents for detailed tool configurations, remediation playbooks, or additional scenarios. The inline code blocks are extensive and could benefit from being split into referenced files (e.g., a separate remediation guide, tool-specific reference docs). However, the section structure itself is well-organized with clear headers. | 2 / 3 |
Total | 9 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.