auditing-kubernetes-cluster-rbac
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.
60
70%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/auditing-kubernetes-cluster-rbac/SKILL.mdQuality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong description with excellent specificity, rich trigger terms, and a clearly distinct niche in Kubernetes RBAC security auditing. Its primary weakness is the absence of an explicit 'Use when...' clause, which would help Claude know precisely when to select this skill over others.
Suggestions
Add a 'Use when...' clause, e.g., 'Use when the user asks to audit, review, or harden Kubernetes RBAC configurations, check for overly permissive roles, or assess cluster security posture.'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: identifying overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths. Also names specific tools: kubectl, rbac-tool, KubiScan, and Kubeaudit. | 3 / 3 |
Completeness | The 'what' is thoroughly covered with specific actions and tools, but there is no explicit 'Use when...' clause or equivalent trigger guidance telling Claude when to select this skill. Per the rubric, a missing 'Use when...' clause caps completeness at 2. | 2 / 3 |
Trigger Term Quality | Excellent coverage of natural terms a user would use: 'Kubernetes', 'RBAC', 'cluster', 'permissions', 'ClusterRoleBindings', 'service account', 'privilege escalation', 'kubectl', plus specific tool names. These are terms a security engineer would naturally use when requesting this kind of audit. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche: Kubernetes RBAC auditing specifically. The combination of RBAC, Kubernetes, and the named security tools makes it very unlikely to conflict with other skills. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
57%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill excels in actionability with fully executable, copy-paste ready commands and scripts for comprehensive Kubernetes RBAC auditing. However, it suffers from being a monolithic document with no progressive disclosure, includes unnecessary concept explanations that Claude already knows, and lacks explicit validation checkpoints between workflow steps despite dealing with security-sensitive operations.
Suggestions
Extract the Key Concepts table, Tools & Systems section, and Common Scenarios into separate referenced files (e.g., CONCEPTS.md, TOOLS.md, SCENARIOS.md) to reduce the main skill's size and improve progressive disclosure.
Remove the Key Concepts table entirely or reduce it to only non-obvious terms like 'automountServiceAccountToken' — Claude already knows what RBAC, ClusterRole, and Service Accounts are.
Add explicit validation checkpoints between workflow steps, such as 'Verify findings from Step 1-2 before running automated tools' and 'Cross-reference automated tool findings with manual enumeration results to eliminate false positives'.
Add a verification step in the scenario showing how to confirm that remediation changes (e.g., removing ClusterRoleBindings) don't break existing workloads before finalizing.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly comprehensive but includes some unnecessary content. The 'Key Concepts' table explains RBAC, ClusterRole, and other Kubernetes concepts that Claude already knows well. The 'When to Use' section is somewhat verbose with its negative examples. The 'Tools & Systems' section repeats information already evident from the workflow. However, the code examples themselves are lean and purposeful. | 2 / 3 |
Actionability | The skill provides fully executable bash commands and Python scripts throughout. Every step includes copy-paste ready code for kubectl queries, rbac-tool commands, KubiScan invocations, and Kubeaudit checks. The inline Python scripts for JSON processing are complete and functional, not pseudocode. | 3 / 3 |
Workflow Clarity | The six steps are clearly sequenced and logically ordered from manual enumeration through automated scanning. However, there are no explicit validation checkpoints or feedback loops between steps. For a security audit involving potentially destructive remediation actions, there's no verify-before-proceeding pattern. The scenario mentions removing ClusterRoleBindings but doesn't include a validation step to confirm workloads still function after changes. | 2 / 3 |
Progressive Disclosure | The skill is a monolithic wall of text at approximately 200+ lines with no references to external files. All content—enumeration scripts, tool commands, scenarios, output format, key concepts—is inline. The Key Concepts table, Tools & Systems section, and detailed scenario could easily be split into separate reference files to keep the main skill lean. | 1 / 3 |
Total | 8 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
9a588e6
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.