Guide · Agent skill
How to use the kube-bench Kubernetes CIS scanning agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the kube-bench agent skill, a packaged set of instructions that lets an AI agent set up kube-bench and run it against a Kubernetes cluster. kube-bench is a free tool from Aqua Security that checks a cluster against the CIS Kubernetes Benchmark, a widely used list of security settings. It is written for platform and DevOps engineers, and after reading you will know how to install the skill, ask for scans in plain language, and wire results into a pipeline.
Kubernetes CIS Scanning with kube-benchmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills.
- 2Check prerequisites. Confirm you have the kube-bench binary or the aquasec/kube-bench container, plus sudo on the nodes or kubectl rights to create Jobs.
- 3Ask for a first scan. Describe your goal in plain language, such as a control-plane scan on a new cluster. The agent will select the benchmark and targets.
- 4Review PASS, FAIL and WARN. Read the per-section summary and the remediation text for each FAIL or WARN. Apply the fixes on the node or manifest.
- 5Re-run and wire into CI. Re-run the target to confirm fixes now pass, then ask the agent to set up JSON or JUnit output and an error-code gate in your pipeline.
What does the skill make the agent do?
Once installed, the agent knows how to set up kube-bench and choose the right benchmark version for your cluster. It can scope a scan to the control plane, etcd, kubelet or worker nodes, and it can output results as JSON or JUnit so pipelines can read them.
A bundled helper script can run kube-bench, summarise PASS, FAIL and WARN results per section, and exit with an error code when failures exist so that CI can block a deployment.
- Installs and runs kube-bench as a Job, DaemonSet or standalone binary
- Selects the benchmark version and node targets
- Emits JSON or JUnit output for pipelines
- Troubleshoots skipped or misdetected checks
How do you install the skill?
Download the ZIP for this skill from this page and unzip it. For personal use, place the folder in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder.
In the Claude apps you can instead upload the skill under Settings, then Capabilities, then Skills.
- Personal: unzip into ~/.claude/skills/
- Project: unzip into .claude/skills/ inside the project
- Claude apps: Settings, Capabilities, Skills, then upload
How do you trigger the skill with natural requests?
You do not need to name the skill. Describe the task in plain language and mention the cluster or target you care about. The skill's description covers first-time setup, choosing benchmark versions and node targets, wiring kube-bench into CI, and troubleshooting skipped checks.
If you want the audit write-up, use the separate performing-kubernetes-cis-benchmark-with-kube-bench skill instead. This skill does not interpret findings or write audit reports.
- Set up kube-bench on my cluster for the first time and run a control-plane scan
- Run kube-bench against the worker nodes and output JSON for my pipeline
- Add a kube-bench gate to our CI so deployments are blocked on failures
- Some kube-bench checks are being skipped on EKS, help me find out why
What does a scan look like?
The basic run auto-detects the version and runs all applicable checks. You can also scope it to component groups such as master, node, etcd and policies, or run it in-cluster as a Job and read the pod logs.
kube-bench reports each check as PASS, FAIL, WARN or INFO, with a remediation recommendation drawn from the CIS guidance. After applying a fix, re-run the relevant target to confirm the check now passes.
sudo kube-bench
sudo kube-bench run --targets master,node,etcd,policies
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs -l app=kube-benchWhat does the skill need before it runs?
You need the kube-bench binary on your PATH, or the aquasec/kube-bench container. Binary mode needs root or sudo on the nodes. In-cluster mode needs kubectl permission to create Jobs. Docker is only needed for the container method, Go only if you install via go install, and Python 3 to run the helper script.
- kube-bench binary on PATH, or the aquasec/kube-bench container
- Root or sudo access to nodes (binary mode)
- kubectl permission to create Jobs (in-cluster mode)
- Docker (container method only)
- Go toolchain (go install method only)
- Python 3 (helper script)
What are the safety notes?
The skill runs scripts and uses the network. Installation and the Job manifest are fetched from GitHub URLs, so check that your environment allows those downloads. The skill's own description says kube-bench reads node configuration files and can run privileged pods.
Only scan clusters you own or are authorised to test. The skill's description says kube-bench should not be run against clusters without authorisation.
- Runs scripts and uses the network
- Reads node configuration files
- Can run privileged pods in-cluster
- Use only on clusters you own or are authorised to test
What people use it for
- Establishing a first CIS baseline for a new cluster before workloads go live
- Adding a hardening gate to a CI/CD pipeline that blocks deployments when checks fail
- Running a scan of worker nodes and sending JSON output to a dashboard
- Diagnosing why certain kube-bench checks are skipped or misdetected on a managed cluster
Frequently asked questions
Is kube-bench free to use?
Yes. The skill's description calls kube-bench a free tool from Aqua Security. The skill itself is licensed under Apache-2.0.
What do I need to install kube-bench agent skill?
Unzip the skill into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it in the Claude apps under Settings, Capabilities, Skills. You also need the kube-bench binary or the aquasec/kube-bench container, and Python 3 for the helper script.
Does kube-bench need root access?
Binary mode needs root or sudo on the nodes because it reads node configuration files. In-cluster mode instead needs kubectl permission to create Jobs.
Can kube-bench output results for CI pipelines?
Yes. It can emit JSON or JUnit output and write it to a file. The bundled helper script can also exit with an error code when failures exist, so CI can block a deployment.
Should I use this skill to write an audit report?
No. The skill's description says it does not interpret findings or produce audit reports. Use the performing-kubernetes-cis-benchmark-with-kube-bench skill for that.
How does kube-bench compare with other scanners?
The source does not compare kube-bench with other tools, so this guide makes no claim about relative accuracy or coverage. kube-bench's focus is checking configuration against the CIS Kubernetes Benchmark, including managed distributions such as EKS, GKE and AKS.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits platform and DevOps engineers who are setting up CIS compliance scanning for the first time or adding a hardening gate to CI. It is not the right choice if you need written audit findings, or if you want to scan clusters you do not own or have no authorisation to test.
Download the skill