registry / k8s-agent-skills / 1.8.6

k8s-agent-skills@1.8.6

Agent skills for Kubernetes cluster operations — Cilium, Talos, Flux, Rook-Ceph, CNPG, Gitea, Tekton, Cert-Manager, VictoriaMetrics, ZITADEL, Harbor, Higress, KServe, Kubeflow, MariaDB, Vector, ExternalDNS, External Secrets, Vault, Dragonfly, Flagger, Sea

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time setup mutates broad AI-agent skill directories by linking this package's local skills. No network or credential-exfiltration behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install executes postinstall when the --check verification detects missing links.

Impact

Adds package-supplied skills to OpenCode, Claude, Codex, and Cursor discovery paths; replaces only matching symlinks or directories containing SKILL.md.

Mechanism

global symlink installation and cleanup of package-owned skill entries

Rationale

The install hook automatically modifies multiple AI-agent control surfaces, warranting a warning under the lifecycle policy. Inspection found no remote payload, secret harvesting, exfiltration, or deceptive prompt manipulation.

Evidence

package.jsonbin/skills-linkREADME.mdskills/stakater-reloader/SKILL.mdskills/*$HOME/.agents/skills$HOME/.config/opencode/skills$HOME/.claude/skills$HOME/.codex/skills$HOME/.cursor/skills

Decision evidence

public snapshot

AI called this at 92.0% confidence with false-positive risk.

k8s-agent-skills@1.8.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code