Skills k8s-security-policies

📦

k8s-security-policies

Name: k8s-security-policies
Author: sickn33

Content revision r1 High Risk 🌐 Network access⚙️ External commands

Secure Kubernetes Policy Design

Kubernetes security policies are difficult to design without overgranting network or API access. This skill provides practical patterns for NetworkPolicy, RBAC, Pod Security Standards, and admission control.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "k8s-security-policies" from https://skillstore.io/skills/sickn33-k8s-security-policies.md and its manifest at https://skillstore.io/api/skills/sickn33-k8s-security-policies/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-k8s-security-policies.md Signed manifest GET /api/skills/sickn33-k8s-security-policies/manifest Signed lockfile GET /api/skills/sickn33-k8s-security-policies/lockfile

Test it

Using "k8s-security-policies". Secure a production namespace for one web service and one API service.

Expected outcome:

A default deny baseline for ingress and egress.
A DNS-only egress allowance for pods that need name resolution.
A frontend-to-API rule limited to the required service port.
Verification steps using policy descriptions and connectivity tests.

Using "k8s-security-policies". Review a service account that can list pods and read one secret.

Expected outcome:

A least-privilege assessment of each permission.
A recommendation to scope secret access by name.
A warning if ClusterRole scope is broader than required.
A short validation checklist for kubectl auth can-i.

Using "k8s-security-policies". Prepare admission controls for application namespaces.

Expected outcome:

Required label checks for workloads.
Pod security level recommendations for each namespace.
A rollout sequence with audit, warn, then enforce stages.

Security Audit

High Risk

v5 • 7/9/2026 Open versioned report

Most static alerts are false positives caused by Markdown fences, inline backticks, and Kubernetes policy terminology. One broad egress NetworkPolicy example is confirmed as risky, and additional RBAC examples grant excessive permissions if copied into production. No prompt injection or malicious execution behavior was found.

Files scanned

713

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

references/rbac-patterns.md:12-14 references/rbac-patterns.md:25-27

Overbroad RBAC Wildcard Examples

The RBAC reference includes wildcard resources and verbs in examples tied to production namespaces. Users could copy policies that grant more access than least privilege requires.

The file directly shows resources ["*"] and verbs ["*"] in named RBAC examples. The surrounding best-practice warning lowers malicious intent, but the copyable production examples remain risky.

High

SKILL.md:150-159

Cluster-Wide Secret Read Example

The main guide shows a ClusterRole named secret-reader with get, watch, and list access to secrets. Broad secret visibility can expose credentials if copied into a real cluster.

The example grants secret access at ClusterRole scope without resourceNames or namespace limits. This is a concrete overprivilege pattern, though it appears educational rather than malicious.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

assets/network-policy-template.yaml:124

Hardcoded IP address

cidr: 0.0.0.0/0

The example allows egress to 0.0.0.0/0 on HTTPS, which can permit broad outbound access if copied into production. It is a legitimate policy example, but the unrestricted destination is a real security weakness.

Risk Factors

🌐 Network access (3)

assets/network-policy-template.yaml:126 assets/network-policy-template.yaml:124 assets/network-policy-template.yaml:126

⚙️ External commands (39)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-k8s-security-policies/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-k8s-security-policies/security.svg)](https://skillstore.io/skills/sickn33-k8s-security-policies?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-k8s-security-policies?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-k8s-security-policies/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-k8s-security-policies.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). k8s-security-policies security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-k8s-security-policies/audits/5

BibTeX citation

@techreport{sickn33-sickn33-k8s-security-policies-2026,
  author = {sickn33},
  title = {k8s-security-policies security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-k8s-security-policies/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "k8s-security-policies security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-k8s-security-policies/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-k8s-security-policies:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

sickn33 Recommended Current

sickn33-k8s-security-policies

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 14

Updated

2026-08-21

wshobson

wshobson-k8s-security-policies

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Design namespace isolation

Create default deny policies and limited service-to-service communication for application namespaces.

Review RBAC permissions

Compare roles and bindings against least-privilege goals before deployment.

Prepare compliance controls

Map Kubernetes policy patterns to audit logging, pod security, and network segmentation requirements.

Try These Prompts

Create a default deny baseline

Create a default deny NetworkPolicy baseline for my namespace. Include DNS egress and explain what inputs I must customize.

Limit service communication

Design NetworkPolicies for a frontend, backend, and database namespace. Allow only required traffic and call out risky assumptions.

Review RBAC for least privilege

Review this RBAC design for least privilege. Identify wildcard access, secret exposure, and safer Role or RoleBinding alternatives.

Harden a multi-tenant cluster

Build a Kubernetes security policy plan for multiple teams. Cover Pod Security Standards, RBAC, admission control, network isolation, and verification steps.

Best Practices

Start with default deny policies, then add only required ingress and egress paths.
Prefer namespaced Roles with specific resources, verbs, and resourceNames where possible.
Use audit and warning modes before enforcing new admission controls.

Avoid

Do not copy wildcard RBAC examples into production without a documented exception.
Do not allow 0.0.0.0/0 egress when a smaller destination set is available.
Do not bind secret-reading permissions at cluster scope unless the use case requires it.