How to use the Kubernetes Security Policies agent skill

What is an agent skill?

An agent skill is a folder containing instructions (a SKILL.md file) and supporting files that an AI agent can load when a task matches the skill's description. The agent reads the guide and uses its examples when it writes answers or files for you.

This skill is one of the plugins in the wshobson/agents collection. It is licensed under MIT.

What does the skill make the agent do?

When the skill is active, the agent can write configuration files for securing a cluster. It is a reference of examples and templates, not a live tool. It does not connect to or change any cluster itself.

• Write NetworkPolicy manifests that control which pods can talk to each other, including a default-deny-all policy and an allow-DNS egress rule.
• Write RBAC rules (Role, ClusterRole, RoleBinding) that limit who can do what, with patterns such as read-only access and secret reader.
• Set pod security settings such as running as non-root, read-only root filesystem, seccomp RuntimeDefault and dropping all Linux capabilities.
• Label namespaces for the Pod Security Standards (privileged, baseline, restricted).
• Provide OPA Gatekeeper ConstraintTemplate and Constraint examples and Istio PeerAuthentication (mTLS) and AuthorizationPolicy examples.
• Suggest kubectl troubleshooting commands for NetworkPolicy and RBAC problems.

How do you install the skill?

Download the ZIP file from this page and unzip it. You can install it for yourself or for a single project.

For your user account, unzip it into ~/.claude/skills/. For one project, unzip it into the project's .claude/skills/ folder. Alternatively, in the Claude apps you can upload the ZIP under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with natural requests?

You do not need a special command. The skill is meant to be used when your request matches its description: securing clusters, implementing network isolation, or enforcing pod security standards. Describe your goal in plain language and name the resource type if you know it.

• Write a default-deny NetworkPolicy for the production namespace, then allow only frontend pods to reach backend on TCP 8080.
• Create a read-only Role for pods in the staging namespace and show me the RoleBinding for a user called jane.
• Label my namespace so Pod Security Standards enforce the restricted profile.
• Harden this Deployment: run as non-root, drop all capabilities and use a read-only root filesystem.
• Set up an OPA Gatekeeper constraint that requires app and environment labels on Deployments.

What does the skill need?

You only need a cluster if you want to apply the output. The skill itself needs no scripts and no network access.

• kubectl access, only if you run the troubleshooting commands yourself.
• A Kubernetes cluster with a CNI plugin that supports NetworkPolicy, for the network examples. The skill's troubleshooting section suggests checking this first.
• OPA Gatekeeper or Istio, only if you use those sections.
• The skill runs no scripts and uses no network.

Example: check RBAC permissions with kubectl

If a service account gets permission denied errors, the skill suggests checking its effective permissions with kubectl auth can-i. You run these yourself against your cluster; the agent does not run them for you.

Safety notes before you apply anything

The generated YAML can block traffic or grant the wrong permissions if applied without review. A default-deny policy applied to the wrong namespace can cut off a working application. Read every manifest, check the namespace and labels, and test in a non-production cluster first.

Treat the output as a starting point for human review. The skill does not audit a live cluster, so it cannot tell you what is actually insecure in your environment.

• Review every manifest before running kubectl apply.
• Check namespaces and label selectors match your workloads.
• Test network policies in a non-production cluster first, as they can block traffic.
• Note that the skill's description mentions PodSecurityPolicy, but PSP was removed from Kubernetes in v1.25. Prefer Pod Security Standards labels instead.

Tips for better results

Give the agent your context: namespace names, pod labels, the ports your app uses and which service accounts exist. The examples use labels such as app: backend and app: frontend, so matching your own labels avoids edits.

For RBAC, ask for the narrowest verbs and resources you need. The reference file references/rbac-patterns.md contains patterns you can ask the agent to adapt. The network template is at assets/network-policy-template.yaml.

• Start with one namespace and a default-deny policy, then add allow rules.
• Ask for the reasoning behind each rule so you can review it.
• Ask the agent to note which CNI features your examples assume.