registry / k8s-agent-skills / 1.8.0

k8s-agent-skills@1.8.0

Agent skills for Kubernetes cluster operations — Cilium, Talos, Flux, Rook-Ceph, CNPG, Gitea, Tekton, Cert-Manager, VictoriaMetrics, ZITADEL, Harbor, Higress, KServe, Kubeflow, MariaDB, Vector, ExternalDNS, External Secrets, Vault, Dragonfly, Flagger, Sea

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time setup mutates AI-agent skill directories by linking this package's skills. No credential collection, network exfiltration, or remote payload execution was found in the executable source.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes `postinstall`.

Impact

Installs package-controlled skill content into configured agent skill roots and may replace colliding skill directories.

Mechanism

global first-party agent-skill symlink setup

Rationale

The automatic global agent-skill installation warrants a warning under the lifecycle policy, but source inspection found no malicious execution, exfiltration, stealth persistence, or remote payload chain.

Evidence

package.jsonbin/skills-linkREADME.md$HOME/.agents/skills$HOME/.config/opencode/skills$HOME/.claude/skills$HOME/.codex/skills$HOME/.cursor/skills

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

k8s-agent-skills@1.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code