CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-k8s-control-plane

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster secrets, workload mutation, and namespace-scoped drift. Use when the user asks to inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure, or why live workloads differ from manifests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

75

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, well-structured instruction-only skill that points cleanly to one real reference file and sequences a three-phase investigation workflow. Actionability and workflow_clarity are strong but sit just below top because no concrete commands or explicit fix-retry feedback loop are given.

Suggestions

Add one or two concrete kubectl/API commands (e.g. 'kubectl auth can-i --list --as=<sa>') to lift actionability from 4 to 5.

Add an explicit validate-then-retry checkpoint in the workflow (e.g. 'if reproduction fails to produce the expected workload/secret effect, re-check the principal-to-edge mapping') to reach top workflow_clarity.

State the expected evidence-block output format once so the 'What To Preserve' section becomes a concrete deliverable rather than a list of fields.

DimensionReasoningScore

Conciseness

Lean and efficient with no padding or explanation of concepts Claude already knows (no 'what is Kubernetes/RBAC'), and every line is actionable — 'Identify the active principal first', 'Distinguish read access, create access, patch access, exec access, and secret access'.

5 / 5

Actionability

Concrete, specific instruction-only guidance ('Compare checked-in YAML against live objects after defaulting, admission mutation, or controller reconciliation'; 'principal -> API permission -> mutated object -> resulting workload') but stops short of copy-paste commands, keeping it just below 5.

4 / 5

Workflow Clarity

Clear three-phase sequence (Map API Trust Path -> Trace Mutation -> Reduce to Decisive Path) with cross-check and reproduce-as-validation steps, but lacks an explicit fix-and-retry feedback loop so it stays below 5.

4 / 5

Progressive Disclosure

Concise overview body signals a single verified one-level-deep reference — 'Load `references/k8s-control-plane.md` for the RBAC checklist, controller checklist, and evidence packaging' — with content appropriately split and easy navigation.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and fully answers what and when while being explicitly scoped to a downstream niche. It uses third-person declarative voice with no first/second-person violations.

DimensionReasoningScore

Specificity

Lists multiple specific concrete capabilities — 'Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster secrets, workload mutation' — giving comprehensive coverage rather than the 1-2 actions of a 3.

5 / 5

Completeness

Explicitly answers both what ('CTF-sandbox workflow for Kubernetes API analysis...') and when ('Use when the user asks to inspect...') with concrete trigger phrases, matching the 5 anchor exactly.

5 / 5

Trigger Term Quality

Natural trigger phrasing a user would say — 'inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure, or why live workloads differ from manifests' — with synonyms (kube/Kubernetes, manifests/live workloads).

5 / 5

Distinctiveness Conflict Risk

Narrow K8s control-plane CTF niche explicitly scoped as a downstream of a named orchestrator ('Use only after `$ctf-sandbox-orchestrator`...'), giving a clear niche with minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.