k8s-security-policies

Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

1.04x

Quality

86%

Does it follow best practices?

Impact

98%

1.04x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable reference skill with executable examples and proper use of bundle files for detail. Its main weakness is the absence of explicit validation/verification checkpoints for applying security policies, which are inherently risky cluster-wide operations.

Suggestions

Add a short 'Apply and verify' workflow with validation checkpoints (e.g. dry-run with `kubectl apply --dry-run=server`, then verify with `kubectl get networkpolicy` / `kubectl auth can-i`) and a rollback step for policy changes.

Trim redundancy: collapse the 'Purpose' section into 'When to Use This Skill' since they restate each other, and tighten the Compliance Frameworks bullet lists.

For destructive/batch policy operations, add an explicit validate -> fix -> retry feedback loop so workflow clarity is not capped by the missing-validation rule.

Dimension	Reasoning	Score
Conciseness	Largely efficient with direct, copy-paste YAML and no padding about what Kubernetes is, though the 'Purpose' section restates 'When to Use' and the Compliance Frameworks section is somewhat list-heavy with minor redundancy.	4 / 5
Actionability	Provides fully executable, copy-paste-ready YAML for the common cases (default-deny, frontend-to-backend, DNS, Role/ClusterRole/RoleBinding, restricted pod, OPA Gatekeeper, Istio) plus concrete troubleshooting commands.	5 / 5
Workflow Clarity	The skill is a reference catalog rather than a sequenced apply-verify-rollback workflow; for cluster-wide security policy changes (effectively batch/risky operations) there are no explicit validation checkpoints or dry-run/verify feedback loops, capping this dimension.	3 / 5
Progressive Disclosure	Well-organized sections with two real one-level-deep references clearly signaled inline ('See assets/network-policy-template.yaml', 'See references/rbac-patterns.md') and templates appropriately split into bundle files.	5 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete resource types and explicit trigger conditions for when to use the skill. It is clearly distinguishable and answers both what and when; the only minor gap is some missing natural synonyms in the trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC', 'securing Kubernetes clusters', 'implementing network isolation', 'enforcing pod security standards') with comprehensive coverage of the domain.	5 / 5
Completeness	Explicitly answers both 'what' (implement NetworkPolicy, PodSecurityPolicy, RBAC for production-grade security) and 'when' ('Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards').	5 / 5
Trigger Term Quality	Includes natural trigger phrases ('securing Kubernetes clusters', 'network isolation', 'pod security standards') but misses common synonyms a user might say such as 'RBAC', 'least privilege', or 'network segmentation'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (Kubernetes security policies) with distinct, specific triggers and minimal overlap risk with unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: wshobson/agents
Path: plugins/kubernetes-operations/skills/k8s-security-policies/SKILL.md
Commit: d6837ae

Reviewed: about 12 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.