Skip to content
Get packs

Kubernetes RBAC Auditor

Audits Kubernetes cluster permissions for overly broad roles, risky bindings and privilege escalation paths.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When this skill is installed, the agent follows a structured playbook for reviewing who can do what inside a Kubernetes cluster. It runs kubectl queries to find roles with wildcard permissions, roles that can read secrets or exec into pods, and bindings that grant powerful roles such as cluster-admin or access to all authenticated users. It also walks through rbac-tool, KubiScan and Kubeaudit to produce a findings report that a security reviewer can act on. The skill is a set of instructions plus helper scripts; it does not itself change cluster settings.

Great for

  • Platform or DevOps engineers preparing a security review of a shared Kubernetes cluster (EKS, GKE, AKS or self-managed)
  • Security teams checking least-privilege access during a compliance audit
  • Incident responders tracing possible lateral movement or privilege escalation through service accounts

Skip it if

  • Network policy or container image scanning, which the skill itself says to handle with other tools like Cilium, Calico, Trivy or Grype (wrong tool for the job)
  • Anyone without read access to the target cluster or without authorisation to audit it; running these queries against systems you do not own or manage could be unauthorised access
  • Teams that expect a one-click fix; it reports findings and does not remediate RBAC configuration

Try asking

  • “Audit my cluster for ClusterRoles with wildcard verbs or resources and summarise the risks”
  • “List every binding that grants cluster-admin and tell me which subjects have it”
  • “Find service accounts and pods that could escalate privileges in this cluster”
  • “Write an RBAC compliance summary I can give to the auditors”
Step-by-step guide: how to use Kubernetes RBAC AuditorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    auditing-kubernetes-cluster-rbac.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip auditing-kubernetes-cluster-rbac.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip auditing-kubernetes-cluster-rbac.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the audit with a read-only kubeconfig or service account first, and only escalate access if the review truly requires it.
  • Review the generated findings yourself; wildcard roles are sometimes intentional for system components, so filter out system: roles before acting.
  • Ask the agent to save results to a file and compare against a previous run to track whether permissions are drifting.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.