Task
SkillCloud & infraReviews Kubernetes network and firewall configurations specifically for AI agent execution sandboxes.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Task skill
What this skill tells your AI
The instructions your AI receives, as published by gke-labs/kube-agents in .agents/skills/review-security-k8s-agents-firewall/SKILL.md and read by ahel’s review.
Review network policies and firewall configs for AI agent control loops and execution sandboxes.
Checks
1. Egress Restrictions
- Sandbox Network: Enforce default-deny egress. Allowlist absolute minimum required IPs/services.
- Internal APIs: Block agent/sandbox access to internal cluster APIs, K8s services, and cloud metadata (e.g.,
169.254.169.254) — on the credential ports (TCP80pre-NAT,988post-NAT), not on port53, which is the Pod's resolver under Cloud DNS for GKE and reaches no token. - Exfiltration Vectors: Flag broad egress (e.g.,
0.0.0.0/0) on agent pods.
2. Ingress & Invocation
- Authorized Sources: Restrict agent API ingress to trusted upstream services (auth gateways, orchestrators).
- Bypass Prevention: Flag LoadBalancer or NodePort exposure on main agent containers lacking strict ingress NetworkPolicies.
Signals
- GitHub stars
- 54
- Forks
- 36
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
review-security-k8s-agents-firewall- Source
- github.com/gke-labs/kube-agents