Agent skill · security · yaklang
kubernetes-pentesting
Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.
Why this skill is useful
Adds detailed attack scripts and techniques for Kubernetes penetration testing that are not commonly known or documented.
What it needs
Requires curl, kubectl installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Kubernetes Pentesting — Expert Attack Playbook AI LOAD INSTRUCTION: Expert Kubernetes attack techniques. Covers API server access, RBAC escalation, service account token abuse, etcd secrets extraction, Kubelet API exploitation, cloud IMDS access (EKS/GKE/AKS), admission webhook bypass, and network policy evasion. Base models miss the distinction between namespace-scoped and cluster-scoped RBAC, and overlook Kubelet's unauthenticated API. 0. RELATED ROUTING Before going deep, consider loading: container-escape-techniques for escaping from a compromised pod to the underlying node linux-privilege-escalation once on a node for escalating to root linux-lateral-movement for pivoting between nodes linux-security-bypass when Pod Security Standards or seccomp profiles restrict your actions ssrf-server-side-request-forgery when exploiting SSRF to reach the K8s API or cloud metadata --- 1. K8S API SERVER ACCESS 1.1 Anonymous Access Check 1.2 Token-Based Authentication (from inside pod) 1.3 Certificate / Kubeconfig Authentication --- 2. RBAC ENUMERATION 2.1 Self-Permission Check 2.2 Role and ClusterRole Enumeration 2.3 Dangerous RBAC Permissions Permission Risk Escalation Path --- --- --- pods/exec Critical Exec into any pod (access secrets, tokens) pods (create) Critical Create privileged pod → node access secrets (get/list) Critical Read all secrets including SA tokens serviceaccounts/token (create) Critical Generate token for any SA nodes/proxy High Proxy to Kubelet API escalate on roles Critical Grant yourself any permission bind on rolebindings Critical Bind any role to yourself impersonate Critical Impersonate any user/SA --- 3. SERVICE ACCOUNT TOKEN ABUSE 3.1 Token Location and Decoding 3.2 Escalation via Service Account 3.3 Token Generation --- 4. ETCD DIRECT ACCESS --- 5. POD ESCAPE TO NODE See container-escape-techniques for detailed escape chains. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/kubernetes-pentesting