Why this verdict
- suspicious: finding skill:skills/performing-kubernetes-penetration-testing:skills/performing-kubernetes-penetration-testing/SKILL.md:104:SUPPLY
- suspicious: finding skill:skills/performing-kubernetes-penetration-testing:skills/performing-kubernetes-penetration-testing/SKILL.md:134:SUPPLY
- suspicious: finding skill:skills/performing-kubernetes-penetration-testing:skills/performing-kubernetes-penetration-testing/SKILL.md:143:SUPPLY
Security findings 3
Supply chain
mediumContextual risklow confidenceUndeclared unpinned dependency install: the skill instructs installing kube-hunter from PyPI without any version pin, so the code executed at test time is not pinned to a reviewed version.
pip install kube-hunter
vector:instruction
Counter-argument considered
The skill body concretely instructs an unpinned PyPI install that the workflow then executes; the pinned-official-registry carve-out requires a pin that is absent, and no declared claim covers the install's provenance or version, so this low-severity contextual supply-chain risk stands.
Supply chain
mediumContextual riskmedium confidenceWorkflow Step 3 instructs the agent to apply an unpinned job.yaml fetched from the mutable main branch of the aquasecurity/kube-bench repository, causing the cluster to run whatever containers and spec that remote manifest contains at run time.
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
vector:instruction
Counter-argument considered
The workflow step applies a live manifest from the mutable main branch into the cluster at run time with no pin; no carve-out covers a mutable-branch fetch executed as an operational step, and the declared description never declares kube-bench or remote fetching - it redirects kube-bench work to a different skill - so the undeclared gate independently sustains the finding.
Supply chain
mediumContextual riskmedium confidenceThe skill instructs the agent to pipe an unpinned install script from the mutable raw.githubusercontent.com master branch directly into /bin/bash, executing remote code with no version pin or integrity check as a setup step of the workflow.
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
vector:instruction
Counter-argument considered
Piping an unpinned script from the mutable master branch into /bin/bash is an unpinned operational workflow step, not a vendor installer confined to fenced install documentation, and no declared claim covers the raw.githubusercontent.com fetch, so the carve-out does not neutralize the finding and it survives.
Open questions 1
What the analysis could not settle from the code alone.
[file request skills/performing-kubernetes-penetration-testing/SKILL.md] What does the Workflow section beginning at line 80 instruct the agent to run — does it invoke the bundled scripts agent.py or process.py, and does it fetch, download, or pipe any remote resource (e.g., curl|bash, unpinned URLs)?
Code execution
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Privilege escalation
highRefutedlow confidenceThe skill instructs the agent to deploy a privileged pod with hostPID, hostNetwork, and a hostPath mount of / on the target cluster and then chroot into the mounted host filesystem, yielding node-level compromise if the authorized-target assumption does not hold.
chroot /host
Why it was refuted
Deploying a privileged hostPID/hostNetwork pod with a hostPath mount of / and chrooting into the host filesystem is exactly the declared core capability - actively simulating attacker techniques against pods via manual kubectl exploitation to find paths to cluster compromise in an authorized penetration test - so the declared-core-capability carve-out applies and the behavior is declared, not concealed.
Coverage gaps 2
Parts of the artifact the static analysis could not fully examine.
request_unanswered request.1: request.0/skill-md-workflow: finding: citation not shown or quote not in it
invalid_judge_finding request.1
