Task
SkillCloud & infraReviews Kubernetes manifests for node boundary violations and risks of node-to-cluster privilege escalation.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Task skill
What this skill tells your AI
The instructions your AI receives, as published by gke-labs/kube-agents in .agents/skills/review-security-k8s-nodes/SKILL.md and read by ahel’s review.
Review K8s manifests for node boundary violations allowing compromised nodes/pods to escalate privileges cluster-wide.
Checks
1. Credential & HostPath Abuse
- Kubelet Credential Theft: Flag
hostPathmounts to sensitive node directories (/etc/kubernetes,/var/lib/kubelet,kubeconfig). Recommend VAPs. - Runtime Socket Mounts: Flag
hostPathmounts to container runtime sockets (e.g.,/var/run/docker.sock,containerd.sock). Enables full node takeover.
2. RBAC & NodeRestriction Bypass
- Overprivileged Node Groups: Flag extra RBAC bindings for
system:nodesorsystem:node:<name>bypassingNodeRestriction. - Node Impersonation: Flag roles granting
impersonateonsystem:nodes. - Node Modification: Flag KSA roles granting node modification (
create,update,patch,deleteonnodes,nodes/status, etc.). Allows malicious relabeling/scheduling.
3. Lateral Pivot via Scheduling
- Malicious Scheduling: Flag broad
tolerations(e.g.,operator: Existswith no key) on untrusted workloads allowing them to schedule on sensitive nodes (e.g. control-plane).
Signals
- GitHub stars
- 54
- Forks
- 36
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
review-security-k8s-nodes- Source
- github.com/gke-labs/kube-agents