Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).
Flag information-disclosure patterns — full-object logging, request echoing, credentials in status/annotations, kubeconfig logging, secret-bearing status (CWE-200, CWE-522, CWE-532, CWE-552).
Flag integration adapters reading credential-like fields from third-party CRDs without treating them as untrusted (RayCluster, SparkApplication, JobSet).
Trace workload lineage to pods. Use when a user wants to trace lineage across any tier such as workload to pods, pod to workload, or job to workload. The user may provide a resource at any level (Workload, Job, Pod, JobSet, etc.) and this skill produces the full tree from Workload down to Pods.
Identify what preempted a workload. Use when a user asks why their workload was evicted or preempted, or wants to identify what preempted it. Investigates Kubernetes events, workload status conditions, and controller logs to trace preemption.
Flag supply-chain hygiene gaps — unpinned image refs, TLS bypass, unjustified go.mod replace directives, curl|sh, moving-tag GitHub Actions (CWE-295, CWE-494).
Build and manage a kind cluster for Workload-Aware Scheduling (WAS) e2e tests. Use when the user wants to set up, run tests against, or tear down a WAS test cluster built from Kubernetes main.
Flag webhook safety regressions — loosened failurePolicy, shortened timeoutSeconds, TLS bypass paths, non-idempotent mutating webhooks.
Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.