[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HM9QCYYTFHK37R7WNFXBBV":3,"skill-same:01M6HM9QCYYTFHK37R7WNFXBBV":120},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":6,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6HM9QCYYTFHK37R7WNFXBBV","implementing-pod-security-admission-controller",null,"Implement Kubernetes Pod Security Admission to enforce baseline and restricted security profiles at namespace level using built-in admission controller.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing pod security admission controller","implementing","controller","security","PS","at","profiles","de","enforce","standards","cm","container","pr","kubernetes","admission-controller","pod-security-standards","pod-security-admission","security-standards","cybersecurity","container-security","2026-11-10 10:12:30",false,"---\nname: implementing-pod-security-admission-controller\ndescription: Implement Kubernetes Pod Security Admission to enforce baseline and restricted security profiles at namespace level using built-in admission controller.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- kubernetes\n- pod-security-admission\n- psa\n- pod-security-standards\n- admission-controller\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\ncategory: implementing-pod-security-admission-controller\n---\n# Implementing Pod Security Admission Controller\n\n## Overview\n\nPod Security Admission (PSA) is a built-in Kubernetes admission controller (stable since v1.25) that enforces Pod Security Standards at the namespace level. It replaces the deprecated PodSecurityPolicy (PSP) and provides three security profiles: Privileged, Baseline, and Restricted, with three enforcement modes: enforce, audit, and warn.\n\n\n## When to Use\n\n- When deploying or configuring implementing pod security admission controller capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes v1.25+ (PSA is stable\u002FGA)\n- kubectl with cluster-admin access\n- No dependency on external tools - PSA is built into kube-apiserver\n\n## Pod Security Standards\n\n### Privileged Profile\n- **Unrestricted** - No restrictions applied\n- Use case: System-level pods (kube-system, monitoring)\n\n### Baseline Profile\n- **Minimally restrictive** - Prevents known privilege escalation\n- Blocks: privileged containers, hostPID, hostIPC, hostNetwork, hostPorts, certain volume types, adding capabilities beyond runtime defaults\n\n### Restricted Profile\n- **Heavily restricted** - Follows security best practices\n- Requires: non-root, drop ALL capabilities, seccomp RuntimeDefault, read-only root filesystem considerations\n- Blocks: Everything in Baseline plus running as root, privilege escalation, non-approved volume types\n\n## Enforcement Modes\n\n| Mode | Behavior | Use Case |\n|------|----------|----------|\n| enforce | Reject pods violating policy | Production enforcement |\n| audit | Log violations to audit log | Pre-enforcement assessment |\n| warn | Show warnings to user | Developer feedback |\n\n## Implementation\n\n### Apply to Namespace via Labels\n\n```yaml\n# Restricted enforcement with audit and warn\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Fenforce-version: v1.28\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: v1.28\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: v1.28\n```\n\n```yaml\n# Baseline enforcement for staging\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: staging\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: baseline\n    pod-security.kubernetes.io\u002Fenforce-version: v1.28\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: v1.28\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: v1.28\n```\n\n```yaml\n# Privileged for system namespaces\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: kube-system\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: privileged\n```\n\n### Apply Labels with kubectl\n\n```bash\n# Set restricted enforcement\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  pod-security.kubernetes.io\u002Fenforce-version=v1.28 \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n\n# Set baseline enforcement\nkubectl label namespace staging \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n\n# Check current labels\nkubectl get namespace production -o jsonpath='{.metadata.labels}' | jq .\n```\n\n## Dry-Run Testing\n\n```bash\n# Test what would happen with restricted policy on a namespace\nkubectl label --dry-run=server --overwrite namespace staging \\\n  pod-security.kubernetes.io\u002Fenforce=restricted\n\n# Output shows existing pods that would violate the policy\n# Warning: existing pods in namespace \"staging\" violate the new PodSecurity enforce level \"restricted:latest\"\n```\n\n## Cluster-Wide Defaults (AdmissionConfiguration)\n\n```yaml\n# \u002Fetc\u002Fkubernetes\u002Fpsa-config.yaml\napiVersion: apiserver.config.k8s.io\u002Fv1\nkind: AdmissionConfiguration\nplugins:\n  - name: PodSecurity\n    configuration:\n      apiVersion: pod-security.admission.config.k8s.io\u002Fv1\n      kind: PodSecurityConfiguration\n      defaults:\n        enforce: baseline\n        enforce-version: latest\n        audit: restricted\n        audit-version: latest\n        warn: restricted\n        warn-version: latest\n      exemptions:\n        usernames: []\n        runtimeClasses: []\n        namespaces:\n          - kube-system\n          - kube-public\n          - kube-node-lease\n          - calico-system\n          - gatekeeper-system\n          - monitoring\n          - falco\n```\n\n### Apply to API Server\n\n```bash\n# Add to kube-apiserver manifests\n# \u002Fetc\u002Fkubernetes\u002Fmanifests\u002Fkube-apiserver.yaml\nspec:\n  containers:\n  - command:\n    - kube-apiserver\n    - --admission-control-config-file=\u002Fetc\u002Fkubernetes\u002Fpsa-config.yaml\n    volumeMounts:\n    - name: psa-config\n      mountPath: \u002Fetc\u002Fkubernetes\u002Fpsa-config.yaml\n      readOnly: true\n  volumes:\n  - name: psa-config\n    hostPath:\n      path: \u002Fetc\u002Fkubernetes\u002Fpsa-config.yaml\n      type: File\n```\n\n## Compliant Pod Examples\n\n### Restricted-Compliant Pod\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: restricted-pod\n  namespace: production\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    runAsGroup: 3000\n    fsGroup: 2000\n    seccompProfile:\n      type: RuntimeDefault\n  automountServiceAccountToken: false\n  containers:\n    - name: app\n      image: myregistry\u002Fmyapp:v1.0.0\n      securityContext:\n        allowPrivilegeEscalation: false\n        readOnlyRootFilesystem: true\n        capabilities:\n          drop:\n            - ALL\n      resources:\n        limits:\n          cpu: 500m\n          memory: 256Mi\n        requests:\n          cpu: 100m\n          memory: 128Mi\n      volumeMounts:\n        - name: tmp\n          mountPath: \u002Ftmp\n  volumes:\n    - name: tmp\n      emptyDir: {}\n```\n\n### Baseline-Compliant Pod\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: baseline-pod\n  namespace: staging\nspec:\n  containers:\n    - name: app\n      image: myregistry\u002Fmyapp:v1.0.0\n      securityContext:\n        allowPrivilegeEscalation: false\n      resources:\n        limits:\n          cpu: 500m\n          memory: 256Mi\n```\n\n## Migration from PodSecurityPolicy\n\n### Step 1: Audit Current State\n```bash\n# Check existing PSPs\nkubectl get psp\n\n# Check which service accounts use which PSP\nkubectl get clusterrolebinding -o json | \\\n  jq '.items[] | select(.roleRef.name | startswith(\"psp-\")) | {name: .metadata.name, subjects: .subjects}'\n```\n\n### Step 2: Map PSP to PSA Profiles\n```bash\n# For each namespace, determine required PSA level\nfor ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do\n  echo \"Namespace: $ns\"\n  kubectl label --dry-run=server namespace $ns \\\n    pod-security.kubernetes.io\u002Fenforce=restricted 2>&1 | head -5\ndone\n```\n\n### Step 3: Apply PSA Labels (Audit First)\n```bash\n# Start with audit mode\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n```\n\n### Step 4: Review and Fix Violations\n```bash\n# Check audit logs for violations\nkubectl get events --field-selector reason=FailedCreate -A\n```\n\n### Step 5: Enable Enforcement\n```bash\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Fenforce=restricted\n```\n\n## Monitoring\n\n```bash\n# Check PSA violations in events\nkubectl get events --all-namespaces --field-selector reason=FailedCreate\n\n# Check audit logs\nkubectl logs -n kube-system kube-apiserver-* | grep \"pod-security.kubernetes.io\"\n\n# List namespace PSA labels\nkubectl get namespaces -L pod-security.kubernetes.io\u002Fenforce\n```\n\n## Best Practices\n\n1. **Start with audit+warn** before enforce to assess impact\n2. **Use dry-run** to test enforcement before applying\n3. **Exempt system namespaces** (kube-system, monitoring) in cluster defaults\n4. **Pin version** (enforce-version) for predictable behavior across upgrades\n5. **Set cluster-wide baseline** as default, then restrict specific namespaces\n6. **Combine with Gatekeeper** for additional custom policies beyond PSA\n7. **Use restricted profile** for all production workloads\n8. **Document exemptions** with clear justification\n","# Implementing Pod Security Admission Controller\n\n## Overview\n\nPod Security Admission (PSA) is a built-in Kubernetes admission controller (stable since v1.25) that enforces Pod Security Standards at the namespace level. It replaces the deprecated PodSecurityPolicy (PSP) and provides three security profiles: Privileged, Baseline, and Restricted, with three enforcement modes: enforce, audit, and warn.\n\n\n## When to Use\n\n- When deploying or configuring implementing pod security admission controller capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes v1.25+ (PSA is stable\u002FGA)\n- kubectl with cluster-admin access\n- No dependency on external tools - PSA is built into kube-apiserver\n\n## Pod Security Standards\n\n### Privileged Profile\n- **Unrestricted** - No restrictions applied\n- Use case: System-level pods (kube-system, monitoring)\n\n### Baseline Profile\n- **Minimally restrictive** - Prevents known privilege escalation\n- Blocks: privileged containers, hostPID, hostIPC, hostNetwork, hostPorts, certain volume types, adding capabilities beyond runtime defaults\n\n### Restricted Profile\n- **Heavily restricted** - Follows security best practices\n- Requires: non-root, drop ALL capabilities, seccomp RuntimeDefault, read-only root filesystem considerations\n- Blocks: Everything in Baseline plus running as root, privilege escalation, non-approved volume types\n\n## Enforcement Modes\n\n| Mode | Behavior | Use Case |\n|------|----------|----------|\n| enforce | Reject pods violating policy | Production enforcement |\n| audit | Log violations to audit log | Pre-enforcement assessment |\n| warn | Show warnings to user | Developer feedback |\n\n## Implementation\n\n### Apply to Namespace via Labels\n\n```yaml\n# Restricted enforcement with audit and warn\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Fenforce-version: v1.28\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: v1.28\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: v1.28\n```\n\n```yaml\n# Baseline enforcement for staging\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: staging\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: baseline\n    pod-security.kubernetes.io\u002Fenforce-version: v1.28\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Faudit-version: v1.28\n    pod-security.kubernetes.io\u002Fwarn: restricted\n    pod-security.kubernetes.io\u002Fwarn-version: v1.28\n```\n\n```yaml\n# Privileged for system namespaces\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: kube-system\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: privileged\n```\n\n### Apply Labels with kubectl\n\n```bash\n# Set restricted enforcement\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Fenforce=restricted \\\n  pod-security.kubernetes.io\u002Fenforce-version=v1.28 \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n\n# Set baseline enforcement\nkubectl label namespace staging \\\n  pod-security.kubernetes.io\u002Fenforce=baseline \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n\n# Check current labels\nkubectl get namespace production -o jsonpath='{.metadata.labels}' | jq .\n```\n\n## Dry-Run Testing\n\n```bash\n# Test what would happen with restricted policy on a namespace\nkubectl label --dry-run=server --overwrite namespace staging \\\n  pod-security.kubernetes.io\u002Fenforce=restricted\n\n# Output shows existing pods that would violate the policy\n# Warning: existing pods in namespace \"staging\" violate the new PodSecurity enforce level \"restricted:latest\"\n```\n\n## Cluster-Wide Defaults (AdmissionConfiguration)\n\n```yaml\n# \u002Fetc\u002Fkubernetes\u002Fpsa-config.yaml\napiVersion: apiserver.config.k8s.io\u002Fv1\nkind: AdmissionConfiguration\nplugins:\n  - name: PodSecurity\n    configuration:\n      apiVersion: pod-security.admission.config.k8s.io\u002Fv1\n      kind: PodSecurityConfiguration\n      defaults:\n        enforce: baseline\n        enforce-version: latest\n        audit: restricted\n        audit-version: latest\n        warn: restricted\n        warn-version: latest\n      exemptions:\n        usernames: []\n        runtimeClasses: []\n        namespaces:\n          - kube-system\n          - kube-public\n          - kube-node-lease\n          - calico-system\n          - gatekeeper-system\n          - monitoring\n          - falco\n```\n\n### Apply to API Server\n\n```bash\n# Add to kube-apiserver manifests\n# \u002Fetc\u002Fkubernetes\u002Fmanifests\u002Fkube-apiserver.yaml\nspec:\n  containers:\n  - command:\n    - kube-apiserver\n    - --admission-control-config-file=\u002Fetc\u002Fkubernetes\u002Fpsa-config.yaml\n    volumeMounts:\n    - name: psa-config\n      mountPath: \u002Fetc\u002Fkubernetes\u002Fpsa-config.yaml\n      readOnly: true\n  volumes:\n  - name: psa-config\n    hostPath:\n      path: \u002Fetc\u002Fkubernetes\u002Fpsa-config.yaml\n      type: File\n```\n\n## Compliant Pod Examples\n\n### Restricted-Compliant Pod\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: restricted-pod\n  namespace: production\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    runAsGroup: 3000\n    fsGroup: 2000\n    seccompProfile:\n      type: RuntimeDefault\n  automountServiceAccountToken: false\n  containers:\n    - name: app\n      image: myregistry\u002Fmyapp:v1.0.0\n      securityContext:\n        allowPrivilegeEscalation: false\n        readOnlyRootFilesystem: true\n        capabilities:\n          drop:\n            - ALL\n      resources:\n        limits:\n          cpu: 500m\n          memory: 256Mi\n        requests:\n          cpu: 100m\n          memory: 128Mi\n      volumeMounts:\n        - name: tmp\n          mountPath: \u002Ftmp\n  volumes:\n    - name: tmp\n      emptyDir: {}\n```\n\n### Baseline-Compliant Pod\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: baseline-pod\n  namespace: staging\nspec:\n  containers:\n    - name: app\n      image: myregistry\u002Fmyapp:v1.0.0\n      securityContext:\n        allowPrivilegeEscalation: false\n      resources:\n        limits:\n          cpu: 500m\n          memory: 256Mi\n```\n\n## Migration from PodSecurityPolicy\n\n### Step 1: Audit Current State\n```bash\n# Check existing PSPs\nkubectl get psp\n\n# Check which service accounts use which PSP\nkubectl get clusterrolebinding -o json | \\\n  jq '.items[] | select(.roleRef.name | startswith(\"psp-\")) | {name: .metadata.name, subjects: .subjects}'\n```\n\n### Step 2: Map PSP to PSA Profiles\n```bash\n# For each namespace, determine required PSA level\nfor ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do\n  echo \"Namespace: $ns\"\n  kubectl label --dry-run=server namespace $ns \\\n    pod-security.kubernetes.io\u002Fenforce=restricted 2>&1 | head -5\ndone\n```\n\n### Step 3: Apply PSA Labels (Audit First)\n```bash\n# Start with audit mode\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Faudit=restricted \\\n  pod-security.kubernetes.io\u002Fwarn=restricted\n```\n\n### Step 4: Review and Fix Violations\n```bash\n# Check audit logs for violations\nkubectl get events --field-selector reason=FailedCreate -A\n```\n\n### Step 5: Enable Enforcement\n```bash\nkubectl label namespace production \\\n  pod-security.kubernetes.io\u002Fenforce=restricted\n```\n\n## Monitoring\n\n```bash\n# Check PSA violations in events\nkubectl get events --all-namespaces --field-selector reason=FailedCreate\n\n# Check audit logs\nkubectl logs -n kube-system kube-apiserver-* | grep \"pod-security.kubernetes.io\"\n\n# List namespace PSA labels\nkubectl get namespaces -L pod-security.kubernetes.io\u002Fenforce\n```\n\n## Best Practices\n\n1. **Start with audit+warn** before enforce to assess impact\n2. **Use dry-run** to test enforcement before applying\n3. **Exempt system namespaces** (kube-system, monitoring) in cluster defaults\n4. **Pin version** (enforce-version) for predictable behavior across upgrades\n5. **Set cluster-wide baseline** as default, then restrict specific namespaces\n6. **Combine with Gatekeeper** for additional custom policies beyond PSA\n7. **Use restricted profile** for all production workloads\n8. **Document exemptions** with clear justification\n",{"name":5,"tags":49,"author":51,"domain":42,"license":15,"version":52,"category":5,"nist_csf":53,"subdomain":43,"description":7,"mitre_attack":58},[37,40,50,39,38],"psa","mahipal","1.0",[54,55,56,57],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[59,60,61,62],"T1610","T1611","T1609","T1525","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fimplementing-pod-security-admission-controller",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill implementing-pod-security-admission-controller",{"tool":77,"command":78},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill implementing-pod-security-admission-controller",{"tool":80,"command":81},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill implementing-pod-security-admission-controller","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002FSKILL.md",true,[85,91,96,102,106,110,116],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",1290,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",5229,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fstandards.md",1099,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002Freferences\u002Fstandards.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflows.md",1066,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002Freferences\u002Fworkflows.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",11706,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002Fscripts\u002Fagent.py",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fprocess.py",5185,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-pod-security-admission-controller\u002Fscripts\u002Fprocess.py",[121,150,176,198,214,233],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":130,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[131,132,133,134,135,136,42,137,138,139,140,141,142,143,144,145,146,147,148,149],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[157,158,159,160,161,42,162,163,164,165,166,167,168,169,170,171,172,173,174,175],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[27,183,147,42,184,185,186,143,144,187,188,189,190,191,192,193,194,195,196,197],"triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[27,205,206,183,147,161,42,207,185,140,208,209,143,144,210,188,171,211,212,213],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":220,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[27,221,222,223,224,225,42,226,227,228,185,229,143,230,231,232,191,34,147,31],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":239,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[240,241,242,243,42,244,245,246,247,248,249,230,250,251,34,252,31,253,254,255],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]