auditing-kubernetes-cluster-rbac

Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/auditing-kubernetes-cluster-rbac/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands and a clear six-step audit sequence, but it loses points for a Key Concepts table that over-explains familiar Kubernetes concepts and for leaving its own reference and script bundle files unlinked from the body.

Suggestions

Link the existing bundle files from the body (e.g. a '## API reference' line pointing to references/api-reference.md and a note on scripts/agent.py) so progressive disclosure is signaled rather than orphaned.

Remove or trim the Key Concepts table explaining RBAC/ClusterRole/Service Account, which Claude already knows, to improve token efficiency.

Add an explicit validation/checkpoint step between scan phases (e.g. 'Review findings and de-duplicate before generating the report') to lift workflow clarity toward 5.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with dense, useful code blocks, but the Key Concepts table explains concepts Claude already knows (RBAC, ClusterRole, Service Account) and each step opens with a one-line restatement of its heading, which could be trimmed.	3 / 5
Actionability	It provides copy-paste-ready, fully executable commands and inline Python scripts across kubectl, rbac-tool, KubiScan, and kubeaudit covering the common enumeration and detection cases.	5 / 5
Workflow Clarity	Six scan steps are clearly sequenced (enumerate roles, audit bindings, rbac-tool, KubiScan, SA tokens, Kubeaudit) with an output format, but there are no explicit validation/checkpoint steps between phases; since the operations are read-only audits the destructive cap does not apply.	4 / 5
Progressive Disclosure	The body has good section structure, but the existing bundle files (references/api-reference.md, scripts/agent.py) are never linked or signaled from the body, and the long inline Python scripts are content that could live in the scripts/ bundle.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, naming concrete RBAC misconfiguration types and the exact tools used, but it omits any explicit "Use when..." trigger guidance, which caps its completeness at 3. Trigger-term coverage is good but lacks synonym breadth.

Suggestions

Append an explicit 'Use when...' clause, e.g. 'Use when auditing Kubernetes RBAC for least-privilege violations, compliance reviews, or investigating privilege escalation in EKS/GKE/AKS clusters.'

Add natural trigger synonyms users might say (e.g. 'RBAC permissions', 'cluster-admin review', 'service account tokens') to broaden keyword coverage toward a 5.

Keep the current tool list and concrete misconfiguration types; they are the strongest part of the description.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete actions/targets ("identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths") plus the four specific tools used, giving comprehensive coverage rather than just a couple of actions.	5 / 5
Completeness	It clearly states what the skill does (auditing RBAC to find specific misconfigurations via named tools) but has no "Use when..." clause or equivalent explicit trigger guidance, capping completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Strong natural terms a K8s security reviewer would say ("Kubernetes cluster RBAC", "roles", "permissions", "ClusterRoleBindings", "privilege escalation") are present, but it lacks synonym variations and broader phrasings users might also say, so it sits just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche (Kubernetes RBAC auditing) anchored to distinctive terms and tool names, making overlap with unrelated skills minimal; it is clearly distinguishable rather than only mostly distinct.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/auditing-kubernetes-cluster-rbac/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.