Skip to content
Get packs

Guide · Agent skill

How to use the Kubernetes RBAC Auditor agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The auditing-kubernetes-cluster-rbac skill teaches an AI agent a structured playbook for reviewing who can do what inside a Kubernetes cluster. It is aimed at platform engineers, security teams and incident responders who need a findings report on RBAC configuration. After this guide you will know what the skill does, how to install it, how to ask for an audit in plain language, and what access and safety conditions to check first.

Kubernetes RBAC Auditormukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Get the ZIP. Download the skill ZIP from this page.
  2. 2Install the skill. Unzip into ~/.claude/skills/ or a project's .claude/skills/, or upload the ZIP under Settings, Capabilities, Skills in the Claude apps.
  3. 3Prepare kubectl access. Confirm kubectl points at the target cluster with cluster-admin or read-equivalent access.
  4. 4Install the helper tools. Install rbac-tool, KubiScan and Kubeaudit as listed in the requirements.
  5. 5Ask for the audit. Describe the scope and purpose in plain language, naming the cluster and the goal.
  6. 6Review the findings. Have a security reviewer check the report and decide on remediation, since the skill does not change cluster settings.

What an agent skill is and what this one does

An agent skill is a folder of instructions and helper files that an AI agent loads when a task matches it. This skill covers RBAC (role-based access control) in Kubernetes. When it is installed, the agent follows a set workflow: it runs kubectl queries to find roles with wildcard permissions, roles that can read secrets or exec into pods, and bindings that grant powerful roles such as cluster-admin or access to all authenticated users.

The skill also walks through rbac-tool, KubiScan and Kubeaudit to produce a findings report that a security reviewer can act on. It is a set of instructions plus helper scripts; it does not itself change cluster settings, and it reports findings rather than fixing RBAC configuration.

Install the skill from the ZIP or the Claude apps

Option 1: download the ZIP from this page and unzip it into ~/.claude/skills/ for your user account, or into a project's .claude/skills/ folder to limit it to that project.

Option 2: in the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP.

Check the requirements before you start

The skill expects kubectl configured with cluster-admin or read-equivalent access to the target cluster. It also uses Python 3 with the kubernetes Python client (used by scripts/agent.py), rbac-tool, KubiScan and Kubeaudit. Access to cluster audit logs is optional but recommended for correlating findings with real API activity.

rbac-tool can be installed as a kubectl krew plugin or as a binary from GitHub. KubiScan installs with pip. Kubeaudit installs with brew or from GitHub releases.

  • kubectl configured for the target cluster with cluster-admin or read-equivalent access
  • Python 3 with the kubernetes Python client
  • rbac-tool (kubectl krew plugin or GitHub binary)
  • KubiScan (pip install kubiscan)
  • Kubeaudit (brew or GitHub releases)
  • Optional: access to cluster audit logs

Trigger the skill with a natural request

You do not need to type a command to use the skill. Describe the review you want and the agent will match it to this skill. Name the cluster context and say what the output is for, so the agent knows the scope. Good requests name the goal, such as a compliance check or an incident trace.

Only run audits against clusters you own or manage, or that you are explicitly authorised to review.

  • Audit RBAC on my staging EKS cluster for wildcard permissions and report the findings.
  • Who can read secrets in this cluster, and which bindings give cluster-admin?
  • Trace whether the service account payments-api could have escalated privileges during last week's incident.

Run the core checks the skill uses

The skill's first checks list ClusterRoles with wildcard verbs or resources, roles that can read secrets, and roles with pods/exec access. Its binding checks list ClusterRoleBindings with their subjects, flag bindings to cluster-admin, and warn about bindings to system:authenticated or system:unauthenticated.

rbac-tool answers who-can questions such as who can get secrets or create pods. KubiScan lists risky roles, service accounts and pods, and checks for privilege escalation paths. The service account checks look for automounted tokens on non-default service accounts.

kubectl rbac-tool who-can get secrets kubectl rbac-tool who-can create pods kubectl rbac-tool analysis

Read the findings and plan remediation

Ask the agent to group findings by severity and by subject, such as which users, groups or service accounts hold each risky permission. Use the report as input for a human reviewer, because the skill does not apply fixes.

If you also need network policy review or container image scanning, the skill itself points to other tools: Cilium or Calico for network policy, and Trivy or Grype for image scanning. Runtime monitoring is covered by Falco or Sysdig Secure, which the skill also lists as out of scope.

What people use it for

  • Preparing a least-privilege review of a shared EKS, GKE or AKS cluster before onboarding new teams.
  • Supporting a compliance audit by documenting who holds secret access and cluster-admin bindings.
  • Tracing possible privilege escalation through service accounts during an incident response.
  • Checking which pods run with automounted service account tokens that could enable lateral movement.

Frequently asked questions

How do I install the auditing-kubernetes-cluster-rbac skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for your user, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings, Capabilities, Skills.

What do I need before running the skill?

You need kubectl configured for the target cluster with cluster-admin or read-equivalent access, Python 3 with the kubernetes client, and the helper tools rbac-tool, KubiScan and Kubeaudit. Access to audit logs is optional but recommended.

Is the skill free to use and what is its licence?

The skill is licensed under Apache-2.0. The helper tools are installed separately and each has its own installation source listed in the requirements.

Does the skill fix my RBAC configuration?

No. The skill reports findings and does not remediate RBAC configuration. A reviewer needs to decide and apply any changes.

Can it check network policies or container images?

No. The skill says to use other tools for those tasks, such as Cilium or Calico for network policy and Trivy or Grype for image scanning.

Is it safe to run on any cluster?

Only run it against clusters you own, manage, or are authorised to audit. The skill runs scripts and uses the network, and read access to a system you do not control could be unauthorised access.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits platform engineers, security teams and incident responders who have authorised read access to a Kubernetes cluster and want a structured RBAC findings report. It is a poor fit if you want automatic fixes, or if your question is about network policy or image scanning, where the skill itself points you to other tools.

Download the skill