competition-k8s-control-plane

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster secrets, workload mutation, and namespace-scoped drift. Use when the user asks to inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure, or why live workloads differ from manifests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, well-structured triage skill that sequences the control-plane analysis clearly and offloads checklists to a single well-signaled reference. Its main gap is actionability: the methodology is concrete but lacks executable kubectl commands or a worked RBAC chain example.

Suggestions

Add 2-3 concrete executable commands (e.g. `kubectl auth can-i --list --as=<sa>` and `kubectl get rolebindings,clusterrolebindings -A -o wide`) so the inspection steps are copy-paste ready.

Include one short worked example of a full edge chain (principal -> RBAC permission -> mutated object -> resulting workload/secret) to make the 'reduce to the decisive cluster path' step concrete.

Optionally point the reproduce step at a specific verification command or output check so the validation loop is explicit rather than implied.

Dimension	Reasoning	Score
Conciseness	A lean ~46-line body of compact bullets that assumes Claude's competence and never explains concepts Claude already knows (no 'Kubernetes is a...' padding); every line earns its place.	3 / 3
Actionability	Procedural guidance is concrete (exact resource kinds, verbs read/create/patch/exec/secret, principal->verb->resource->namespace->object chain) but there are no executable commands (e.g. `kubectl auth can-i --list`) or worked examples, leaving it at 'concrete guidance but incomplete' rather than copy-paste ready.	2 / 3
Workflow Clarity	Clear numbered sequence (Quick Start 1-5 and three Workflow phases) with explicit branch checkpoints ('If the problem narrows down... switch back', 'return to `$ctf-sandbox-orchestrator` first') and a reproduce-to-verify step; this is analysis rather than a destructive operation so the validation bar is met.	3 / 3
Progressive Disclosure	A concise overview body with one clearly-signaled, one-level-deep reference ('Load `references/k8s-control-plane.md` for the RBAC checklist, controller checklist, and evidence packaging'), and that file exists and matches the described contents.	3 / 3
	Total	11 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped downstream skill description: it states concrete capabilities, gives natural trigger terms, answers both what and when, and uses an explicit routing constraint to avoid conflict with sibling skills. No first/second-person voice issues.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions and domains ('Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior... inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure'), matching the comprehensive anchor; voice is third person so no penalty applies.	3 / 3
Completeness	Explicitly answers both what (the workflow domains) and when ('Use when the user asks to inspect kube API permissions...'), with an explicit 'Use when...' clause so it is not capped at 2.	3 / 3
Trigger Term Quality	Uses natural phrasings a user would actually say ('inspect kube API permissions', 'service-account tokens', 'admission webhooks', 'secret exposure', 'why live workloads differ from manifests'), giving good coverage rather than just some relevant keywords.	3 / 3
Distinctiveness Conflict Risk	Clear k8s control-plane niche plus an explicit routing constraint ('Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here') makes triggering for the wrong skill unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: CTF-Sandbox-Orchestrator/competition-k8s-control-plane/SKILL.md
Commit: 6aa1362

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.