Kubernetes CIS Scanning with kube-bench
Install and run kube-bench against a Kubernetes cluster and get CIS benchmark results as JSON or JUnit
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 4 files
What it does
Once installed, the agent knows how to set up kube-bench, a free tool from Aqua Security that checks a Kubernetes cluster against the CIS Kubernetes Benchmark, a widely used list of security settings. It can pick the right benchmark version, scope scans to control plane, etcd, kubelet, or worker nodes, and output JSON or JUnit for pipelines. A bundled helper script can run kube-bench, summarise PASS/FAIL/WARN results per section, and exit with an error code when failures exist so CI can block deployments.
Great for
- Platform or DevOps engineers setting up cluster compliance scanning for the first time
- Teams adding a CIS hardening gate to CI/CD pipelines
- Engineers troubleshooting skipped or misdetected kube-bench checks
Skip it if
- Interpreting findings or writing a formal audit report; the skill itself says to use performing-kubernetes-cis-benchmark-with-kube-bench for that
- Running scans on clusters you do not own or have no authorisation to test, since it reads node configuration files and can run privileged pods
Try asking
- “Set up kube-bench on my EKS cluster and run it as a Kubernetes Job”
- “Run kube-bench against only the master and etcd targets using CIS 1.8”
- “Produce a JUnit report from kube-bench for our GitHub Actions pipeline”
- “Why is kube-bench skipping several node checks on our cluster?”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
benchmarking-kubernetes-with-kube-bench.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip benchmarking-kubernetes-with-kube-bench.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip benchmarking-kubernetes-with-kube-bench.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Let kube-bench auto-detect the version first, then pin --benchmark only if detection is wrong
- Review the Job manifest and privileges before applying it, since it mounts host files
- Use --skip sparingly and document any accepted exceptions so later scans stay meaningful
What's inside
- references/api-reference.md
- references/standards.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.