Skip to content
Get packs

Kubernetes Cluster Attack Techniques

Guides an agent through offensive Kubernetes attack techniques, from pod foothold to cluster-wide compromise.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill is a detailed offensive playbook that teaches an AI agent how to attack a Kubernetes cluster after it has gained a foothold, such as a shell inside a compromised pod, a stolen token, or an exposed API server. It walks through enumerating permissions, stealing and impersonating service account tokens, finding risky RBAC roles, reaching the kubelet and etcd, escaping containers, and reaching cloud metadata for credentials. It is written for security testing and gives the agent ready-made commands and tool names such as kubectl, kube-hunter, peirates, kubeaudit and kdigger.

Great for

  • Security engineers performing authorised penetration tests or red-team exercises against Kubernetes clusters they are permitted to test
  • Platform teams who want to understand which RBAC, kubelet or metadata misconfigurations an attacker would exploit so they can fix them
  • Students learning Kubernetes attack paths inside a lab or deliberately vulnerable cluster

Skip it if

  • Attacking clusters or cloud accounts without written authorisation, which is illegal and causes real harm to the owners
  • Production clusters without a rollback and scope plan, because active enumeration and exploitation can disrupt workloads or trigger alerts
  • Beginners who want to secure a cluster, since the skill focuses on offence and does not provide hardening steps

Try asking

  • “Enumerate what my service account in this pod can access and list any dangerous RBAC permissions in our test cluster”
  • “Check whether the kubelet read-only port 10255 is exposed on these nodes and what it reveals”
  • “Map the privilege escalation paths from this compromised pod to cluster-admin in our authorised lab”
  • “Audit our cluster roles for wildcard permissions using kubeaudit and summarise the findings”
Step-by-step guide: how to use Kubernetes Cluster Attack TechniquesInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-k8s-attacks.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-k8s-attacks.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-k8s-attacks.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use this skill against clusters you own or have written permission to test, and state the scope and authorisation in your request
  • Run the agent in an isolated lab or staging environment first, and review each command before it executes, especially active scans and write operations such as creating pods
  • Ask for findings as a remediation report so the output helps you harden the cluster rather than only listing attack steps

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.