# Integration Adapter Trust Boundary

> Integration Adapter Trust Boundary is an Agent Skill for devops & security published in the kubernetes-sigs/kueue repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Flag integration adapters reading credential-like fields from third-party CRDs without treating them as untrusted (RayCluster, SparkApplication, JobSet).

- Skill name: `integration-adapter-trust-boundary`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/kubernetes-sigs/kueue/blob/HEAD/cmd/experimental/skills/reviewer/security/integration-adapter-trust-boundary/SKILL.md
- Repository: kubernetes-sigs/kueue (2,719 GitHub stars when collected)

## SKILL.md

# Skill: Integration-Adapter Trust Boundary

- Adapters in `pkg/controller/jobs/<framework>/` that newly read credential-like
  fields from a third-party CRD (`RayCluster` head-node secret refs, `SparkApplication`
  driver env, JobSet pod template env) without treating those fields as untrusted —
  validate before forwarding, never log, never copy into Kueue-owned status.

---

Source: https://www.openparable.com/skill/devops-security/integration-adapter-trust-boundary (OpenParable). Cite the canonical URL above.