[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71BH5E8KA9TC8DHA91C43DA":3,"skill-same:01M71BH5E8KA9TC8DHA91C43DA":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":58,"updatedAt":59,"install":60,"resources":72},"01M71BH5E8KA9TC8DHA91C43DA","cyber-scanning-kubernetes-manifests-with-kubesec",null,"Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and deviations from security best practices.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-scanning-kubernetes-manifests-with-kubesec\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"scanning","kubesec","scanning kubernetes manifests with kubesec","cyber scanning kubernetes manifests with kubesec","kubernetes","with","manifests","ci-cd","security best practices","security","devsecops","privilege escalation","container-security","subdomain","analysis","false","cybersecurity","ci","static","static-analysis","2026-11-10 10:12:30",false,"---\nname: cyber-scanning-kubernetes-manifests-with-kubesec\ndescription: \"Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and deviations from security best practices.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: scanning-kubernetes-manifests-with-kubesec | description: Perform security risk analysis on Kubernetes resource manifests using |   Kubesec to identify misconfigurations, privilege escalation risks, and deviations |   from security best practices. | domain: cybersecurity | subdomain: container-security | tags: | - kubesec | - kubernetes | - manifest-scanning | - security-scanning | - devsecops | - misconfiguration | - static-analysis | - ci-cd | version: '1.0' | author: mahipal | license: \"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Scanning Kubernetes Manifests with Kubesec\n\n## Overview\n\nKubesec is an open-source security risk analysis tool developed by ControlPlane that inspects Kubernetes resource manifests for common exploitable risks such as privilege escalation, writable host mounts, and excessive capabilities. It assigns a numerical security score to each resource and provides actionable recommendations for hardening. Kubesec can be used as a CLI binary, Docker container, kubectl plugin, admission webhook, or REST API endpoint.\n\n\n## When to Use\n\n- When conducting security assessments that involve scanning kubernetes manifests with kubesec\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Kubernetes manifest files (YAML\u002FJSON) for Deployments, Pods, DaemonSets, StatefulSets\n- Docker or Go runtime for local installation\n- kubectl access for scanning live cluster resources\n- CI\u002FCD pipeline access for automated scanning integration\n\n## Core Concepts\n\n### Security Scoring System\n\nKubesec assigns a score to each Kubernetes resource based on security checks:\n\n- **Positive scores**: Awarded for security-enhancing configurations (readOnlyRootFilesystem, runAsNonRoot)\n- **Zero or negative scores**: Indicate missing security controls or dangerous configurations\n- **Critical advisories**: Flagged configurations that represent immediate security risks\n\n### Check Categories\n\n1. **Privilege Controls**: Checks for privileged containers, host PID\u002Fnetwork access, root execution\n2. **Capabilities**: Identifies excessive Linux capabilities (SYS_ADMIN, NET_RAW)\n3. **Volume Mounts**: Detects dangerous host path mounts and writable sensitive paths\n4. **Resource Limits**: Validates presence of CPU\u002Fmemory resource constraints\n5. **Security Context**: Verifies seccomp profiles, AppArmor annotations, SELinux contexts\n\n## Installation\n\n### Binary Installation\n\n```bash\n# Linux\u002FmacOS\ncurl -sSL https:\u002F\u002Fgithub.com\u002Fcontrolplaneio\u002Fkubesec\u002Freleases\u002Flatest\u002Fdownload\u002Fkubesec_linux_amd64.tar.gz | \\\n  tar xz -C \u002Fusr\u002Flocal\u002Fbin\u002F kubesec\n\n# Verify installation\nkubesec version\n```\n\n### Docker Installation\n\n```bash\ndocker pull kubesec\u002Fkubesec:v2\n\n# Scan a manifest file\ndocker run -i kubesec\u002Fkubesec:v2 scan \u002Fdev\u002Fstdin \u003C deployment.yaml\n```\n\n### kubectl Plugin\n\n```bash\nkubectl krew install kubesec-scan\nkubectl kubesec-scan pod mypod -n default\n```\n\n## Practical Scanning\n\n### Scanning a Single Manifest\n\n```bash\n# Scan a deployment manifest\nkubesec scan deployment.yaml\n\n# Scan with JSON output\nkubesec scan -o json deployment.yaml\n\n# Scan from stdin\ncat pod.yaml | kubesec scan -\n```\n\n### Sample Output\n\n```json\n[\n  {\n    \"object\": \"Pod\u002Fweb-app.default\",\n    \"valid\": true,\n    \"fileName\": \"pod.yaml\",\n    \"message\": \"Passed with a score of 3 points\",\n    \"score\": 3,\n    \"scoring\": {\n      \"passed\": [\n        {\n          \"id\": \"ReadOnlyRootFilesystem\",\n          \"selector\": \"containers[] .securityContext .readOnlyRootFilesystem == true\",\n          \"reason\": \"An immutable root filesystem prevents applications from writing to their local disk\",\n          \"points\": 1\n        },\n        {\n          \"id\": \"RunAsNonRoot\",\n          \"selector\": \"containers[] .securityContext .runAsNonRoot == true\",\n          \"reason\": \"Force the running image to run as a non-root user\",\n          \"points\": 1\n        },\n        {\n          \"id\": \"LimitsCPU\",\n          \"selector\": \"containers[] .resources .limits .cpu\",\n          \"reason\": \"Enforcing CPU limits prevents DOS via resource exhaustion\",\n          \"points\": 1\n        }\n      ],\n      \"advise\": [\n        {\n          \"id\": \"ApparmorAny\",\n          \"selector\": \"metadata .annotations .\\\"container.apparmor.security.beta.kubernetes.io\u002Fnginx\\\"\",\n          \"reason\": \"Well defined AppArmor policies reduce the attack surface of the container\",\n          \"points\": 3\n        },\n        {\n          \"id\": \"ServiceAccountName\",\n          \"selector\": \".spec .serviceAccountName\",\n          \"reason\": \"Service accounts restrict Kubernetes API access and should be configured\",\n          \"points\": 3\n        }\n      ]\n    }\n  }\n]\n```\n\n### Scanning Multiple Resources\n\n```bash\n# Scan all YAML files in a directory\nfor file in manifests\u002F*.yaml; do\n  echo \"=== Scanning $file ===\"\n  kubesec scan \"$file\"\ndone\n\n# Scan multi-document YAML\nkubesec scan multi-resource.yaml\n```\n\n### Using the HTTP API\n\n```bash\n# Scan via the public API\ncurl -sSX POST --data-binary @deployment.yaml \\\n  https:\u002F\u002Fv2.kubesec.io\u002Fscan\n\n# Run a local API server\nkubesec http --port 8080 &\n\n# Scan against local server\ncurl -sSX POST --data-binary @deployment.yaml \\\n  http:\u002F\u002Flocalhost:8080\u002Fscan\n```\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n\n```yaml\nname: Kubesec Scan\non: [pull_request]\njobs:\n  kubesec:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - name: Install Kubesec\n        run: |\n          curl -sSL https:\u002F\u002Fgithub.com\u002Fcontrolplaneio\u002Fkubesec\u002Freleases\u002Flatest\u002Fdownload\u002Fkubesec_linux_amd64.tar.gz | \\\n            tar xz -C \u002Fusr\u002Flocal\u002Fbin\u002F kubesec\n      - name: Scan Manifests\n        run: |\n          FAIL=0\n          for file in k8s\u002F*.yaml; do\n            SCORE=$(kubesec scan \"$file\" | jq '.[0].score')\n            echo \"$file: score=$SCORE\"\n            if [ \"$SCORE\" -lt 0 ]; then\n              echo \"FAIL: $file has critical issues (score: $SCORE)\"\n              FAIL=1\n            fi\n          done\n          exit $FAIL\n```\n\n### GitLab CI\n\n```yaml\nkubesec-scan:\n  stage: security\n  image: kubesec\u002Fkubesec:v2\n  script:\n    - |\n      for file in k8s\u002F*.yaml; do\n        kubesec scan \"$file\" > \u002Ftmp\u002Fresult.json\n        SCORE=$(cat \u002Ftmp\u002Fresult.json | jq '.[0].score')\n        if [ \"$SCORE\" -lt 0 ]; then\n          echo \"CRITICAL: $file scored $SCORE\"\n          cat \u002Ftmp\u002Fresult.json | jq '.[0].scoring.critical'\n          exit 1\n        fi\n      done\n  artifacts:\n    paths:\n      - kubesec-results\u002F\n```\n\n### Admission Webhook\n\nDeploy Kubesec as a ValidatingWebhookConfiguration to reject insecure manifests at deploy time:\n\n```yaml\napiVersion: admissionregistration.k8s.io\u002Fv1\nkind: ValidatingWebhookConfiguration\nmetadata:\n  name: kubesec-webhook\nwebhooks:\n  - name: kubesec.controlplane.io\n    rules:\n      - apiGroups: [\"\"]\n        apiVersions: [\"v1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"pods\"]\n      - apiGroups: [\"apps\"]\n        apiVersions: [\"v1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"deployments\", \"daemonsets\", \"statefulsets\"]\n    clientConfig:\n      service:\n        name: kubesec-webhook\n        namespace: kube-system\n        path: \u002Fscan\n    failurePolicy: Fail\n    sideEffects: None\n    admissionReviewVersions: [\"v1\"]\n```\n\n## Security Checks Reference\n\n### Critical Checks (Negative Score)\n\n| Check | Selector | Risk |\n|-------|----------|------|\n| Privileged | `securityContext.privileged == true` | Full host access |\n| HostPID | `spec.hostPID == true` | Process namespace escape |\n| HostNetwork | `spec.hostNetwork == true` | Network namespace escape |\n| SYS_ADMIN | `capabilities.add contains SYS_ADMIN` | Near-root capability |\n\n### Best Practice Checks (Positive Score)\n\n| Check | Points | Description |\n|-------|--------|-------------|\n| ReadOnlyRootFilesystem | +1 | Prevents filesystem writes |\n| RunAsNonRoot | +1 | Non-root process execution |\n| RunAsUser > 10000 | +1 | High UID reduces collision risk |\n| LimitsCPU | +1 | Prevents CPU resource exhaustion |\n| LimitsMemory | +1 | Prevents memory resource exhaustion |\n| RequestsCPU | +1 | Ensures scheduler resource awareness |\n| ServiceAccountName | +3 | Explicit service account |\n| AppArmor annotation | +3 | Kernel-level MAC enforcement |\n| Seccomp profile | +4 | Syscall filtering |\n\n## References\n\n- [Kubesec GitHub Repository](https:\u002F\u002Fgithub.com\u002Fcontrolplaneio\u002Fkubesec)\n- [Kubesec Online Scanner](https:\u002F\u002Fkubesec.io\u002F)\n- [ControlPlane Security Tools](https:\u002F\u002Fcontrolplane.io\u002F)\n- [CIS Kubernetes Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fkubernetes)\n- [Kubernetes Pod Security Standards](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-standards\u002F)\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Scanning Kubernetes Manifests with Kubesec\n\n## Overview\n\nKubesec is an open-source security risk analysis tool developed by ControlPlane that inspects Kubernetes resource manifests for common exploitable risks such as privilege escalation, writable host mounts, and excessive capabilities. It assigns a numerical security score to each resource and provides actionable recommendations for hardening. Kubesec can be used as a CLI binary, Docker container, kubectl plugin, admission webhook, or REST API endpoint.\n\n\n## When to Use\n\n- When conducting security assessments that involve scanning kubernetes manifests with kubesec\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Kubernetes manifest files (YAML\u002FJSON) for Deployments, Pods, DaemonSets, StatefulSets\n- Docker or Go runtime for local installation\n- kubectl access for scanning live cluster resources\n- CI\u002FCD pipeline access for automated scanning integration\n\n## Core Concepts\n\n### Security Scoring System\n\nKubesec assigns a score to each Kubernetes resource based on security checks:\n\n- **Positive scores**: Awarded for security-enhancing configurations (readOnlyRootFilesystem, runAsNonRoot)\n- **Zero or negative scores**: Indicate missing security controls or dangerous configurations\n- **Critical advisories**: Flagged configurations that represent immediate security risks\n\n### Check Categories\n\n1. **Privilege Controls**: Checks for privileged containers, host PID\u002Fnetwork access, root execution\n2. **Capabilities**: Identifies excessive Linux capabilities (SYS_ADMIN, NET_RAW)\n3. **Volume Mounts**: Detects dangerous host path mounts and writable sensitive paths\n4. **Resource Limits**: Validates presence of CPU\u002Fmemory resource constraints\n5. **Security Context**: Verifies seccomp profiles, AppArmor annotations, SELinux contexts\n\n## Installation\n\n### Binary Installation\n\n```bash\n# Linux\u002FmacOS\ncurl -sSL https:\u002F\u002Fgithub.com\u002Fcontrolplaneio\u002Fkubesec\u002Freleases\u002Flatest\u002Fdownload\u002Fkubesec_linux_amd64.tar.gz | \\\n  tar xz -C \u002Fusr\u002Flocal\u002Fbin\u002F kubesec\n\n# Verify installation\nkubesec version\n```\n\n### Docker Installation\n\n```bash\ndocker pull kubesec\u002Fkubesec:v2\n\n# Scan a manifest file\ndocker run -i kubesec\u002Fkubesec:v2 scan \u002Fdev\u002Fstdin \u003C deployment.yaml\n```\n\n### kubectl Plugin\n\n```bash\nkubectl krew install kubesec-scan\nkubectl kubesec-scan pod mypod -n default\n```\n\n## Practical Scanning\n\n### Scanning a Single Manifest\n\n```bash\n# Scan a deployment manifest\nkubesec scan deployment.yaml\n\n# Scan with JSON output\nkubesec scan -o json deployment.yaml\n\n# Scan from stdin\ncat pod.yaml | kubesec scan -\n```\n\n### Sample Output\n\n```json\n[\n  {\n    \"object\": \"Pod\u002Fweb-app.default\",\n    \"valid\": true,\n    \"fileName\": \"pod.yaml\",\n    \"message\": \"Passed with a score of 3 points\",\n    \"score\": 3,\n    \"scoring\": {\n      \"passed\": [\n        {\n          \"id\": \"ReadOnlyRootFilesystem\",\n          \"selector\": \"containers[] .securityContext .readOnlyRootFilesystem == true\",\n          \"reason\": \"An immutable root filesystem prevents applications from writing to their local disk\",\n          \"points\": 1\n        },\n        {\n          \"id\": \"RunAsNonRoot\",\n          \"selector\": \"containers[] .securityContext .runAsNonRoot == true\",\n          \"reason\": \"Force the running image to run as a non-root user\",\n          \"points\": 1\n        },\n        {\n          \"id\": \"LimitsCPU\",\n          \"selector\": \"containers[] .resources .limits .cpu\",\n          \"reason\": \"Enforcing CPU limits prevents DOS via resource exhaustion\",\n          \"points\": 1\n        }\n      ],\n      \"advise\": [\n        {\n          \"id\": \"ApparmorAny\",\n          \"selector\": \"metadata .annotations .\\\"container.apparmor.security.beta.kubernetes.io\u002Fnginx\\\"\",\n          \"reason\": \"Well defined AppArmor policies reduce the attack surface of the container\",\n          \"points\": 3\n        },\n        {\n          \"id\": \"ServiceAccountName\",\n          \"selector\": \".spec .serviceAccountName\",\n          \"reason\": \"Service accounts restrict Kubernetes API access and should be configured\",\n          \"points\": 3\n        }\n      ]\n    }\n  }\n]\n```\n\n### Scanning Multiple Resources\n\n```bash\n# Scan all YAML files in a directory\nfor file in manifests\u002F*.yaml; do\n  echo \"=== Scanning $file ===\"\n  kubesec scan \"$file\"\ndone\n\n# Scan multi-document YAML\nkubesec scan multi-resource.yaml\n```\n\n### Using the HTTP API\n\n```bash\n# Scan via the public API\ncurl -sSX POST --data-binary @deployment.yaml \\\n  https:\u002F\u002Fv2.kubesec.io\u002Fscan\n\n# Run a local API server\nkubesec http --port 8080 &\n\n# Scan against local server\ncurl -sSX POST --data-binary @deployment.yaml \\\n  http:\u002F\u002Flocalhost:8080\u002Fscan\n```\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n\n```yaml\nname: Kubesec Scan\non: [pull_request]\njobs:\n  kubesec:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - name: Install Kubesec\n        run: |\n          curl -sSL https:\u002F\u002Fgithub.com\u002Fcontrolplaneio\u002Fkubesec\u002Freleases\u002Flatest\u002Fdownload\u002Fkubesec_linux_amd64.tar.gz | \\\n            tar xz -C \u002Fusr\u002Flocal\u002Fbin\u002F kubesec\n      - name: Scan Manifests\n        run: |\n          FAIL=0\n          for file in k8s\u002F*.yaml; do\n            SCORE=$(kubesec scan \"$file\" | jq '.[0].score')\n            echo \"$file: score=$SCORE\"\n            if [ \"$SCORE\" -lt 0 ]; then\n              echo \"FAIL: $file has critical issues (score: $SCORE)\"\n              FAIL=1\n            fi\n          done\n          exit $FAIL\n```\n\n### GitLab CI\n\n```yaml\nkubesec-scan:\n  stage: security\n  image: kubesec\u002Fkubesec:v2\n  script:\n    - |\n      for file in k8s\u002F*.yaml; do\n        kubesec scan \"$file\" > \u002Ftmp\u002Fresult.json\n        SCORE=$(cat \u002Ftmp\u002Fresult.json | jq '.[0].score')\n        if [ \"$SCORE\" -lt 0 ]; then\n          echo \"CRITICAL: $file scored $SCORE\"\n          cat \u002Ftmp\u002Fresult.json | jq '.[0].scoring.critical'\n          exit 1\n        fi\n      done\n  artifacts:\n    paths:\n      - kubesec-results\u002F\n```\n\n### Admission Webhook\n\nDeploy Kubesec as a ValidatingWebhookConfiguration to reject insecure manifests at deploy time:\n\n```yaml\napiVersion: admissionregistration.k8s.io\u002Fv1\nkind: ValidatingWebhookConfiguration\nmetadata:\n  name: kubesec-webhook\nwebhooks:\n  - name: kubesec.controlplane.io\n    rules:\n      - apiGroups: [\"\"]\n        apiVersions: [\"v1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"pods\"]\n      - apiGroups: [\"apps\"]\n        apiVersions: [\"v1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"deployments\", \"daemonsets\", \"statefulsets\"]\n    clientConfig:\n      service:\n        name: kubesec-webhook\n        namespace: kube-system\n        path: \u002Fscan\n    failurePolicy: Fail\n    sideEffects: None\n    admissionReviewVersions: [\"v1\"]\n```\n\n## Security Checks Reference\n\n### Critical Checks (Negative Score)\n\n| Check | Selector | Risk |\n|-------|----------|------|\n| Privileged | `securityContext.privileged == true` | Full host access |\n| HostPID | `spec.hostPID == true` | Process namespace escape |\n| HostNetwork | `spec.hostNetwork == true` | Network namespace escape |\n| SYS_ADMIN | `capabilities.add contains SYS_ADMIN` | Near-root capability |\n\n### Best Practice Checks (Positive Score)\n\n| Check | Points | Description |\n|-------|--------|-------------|\n| ReadOnlyRootFilesystem | +1 | Prevents filesystem writes |\n| RunAsNonRoot | +1 | Non-root process execution |\n| RunAsUser > 10000 | +1 | High UID reduces collision risk |\n| LimitsCPU | +1 | Prevents CPU resource exhaustion |\n| LimitsMemory | +1 | Prevents memory resource exhaustion |\n| RequestsCPU | +1 | Ensures scheduler resource awareness |\n| ServiceAccountName | +3 | Explicit service account |\n| AppArmor annotation | +3 | Kernel-level MAC enforcement |\n| Seccomp profile | +4 | Syscall filtering |\n\n## References\n\n- [Kubesec GitHub Repository](https:\u002F\u002Fgithub.com\u002Fcontrolplaneio\u002Fkubesec)\n- [Kubesec Online Scanner](https:\u002F\u002Fkubesec.io\u002F)\n- [ControlPlane Security Tools](https:\u002F\u002Fcontrolplane.io\u002F)\n- [CIS Kubernetes Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fkubernetes)\n- [Kubernetes Pod Security Standards](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fsecurity\u002Fpod-security-standards\u002F)\n",{"hide":49,"name":5,"source":50,"license":15,"description":7,"authorized_lab":45,"origin_frontmatter":51},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: scanning-kubernetes-manifests-with-kubesec | description: Perform security risk analysis on Kubernetes resource manifests using |   Kubesec to identify misconfigurations, privilege escalation risks, and deviations |   from security best practices. | domain: cybersecurity | subdomain: container-security | tags: | - kubesec | - kubernetes | - manifest-scanning | - security-scanning | - devsecops | - misconfiguration | - static-analysis | - ci-cd | version: '1.0' | author: mahipal | license: ","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-scanning-kubernetes-manifests-with-kubesec",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":49},[62,65,68],{"tool":63,"command":64},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-scanning-kubernetes-manifests-with-kubesec",{"tool":66,"command":67},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-scanning-kubernetes-manifests-with-kubesec",{"tool":69,"command":70},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-scanning-kubernetes-manifests-with-kubesec","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-scanning-kubernetes-manifests-with-kubesec\u002FSKILL.md",[],[74,97,121,149,178,197],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":44},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[82,83,29,84,85,86,87,88,89,90,91,92,93,94,95,96],"zoom out","zoom","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":44},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[104,105,84,106,107,108,109,110,111,112,113,90,114,92,115,116,117,118,119,120],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":130,"publishedAt":44},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[131,132,133,134,135,136,137,138,139,92,140,141,142,143,144,145,146,108,147,148],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":163,"publishedAt":44},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[155,158],{"categoryNo":156,"categoryName":157,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":159,"categoryName":160,"taxonomyType":161,"taxonomyTypeDesc":162},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[164,94,165,131,84,166,167,168,108,169,170,171,172,173,174,175,176,177,90,92],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":44},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[185,186,187,188,189,190,191,192,193,92,194,115,195,196],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":215,"publishedAt":44},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[203,206,209,212],{"categoryNo":204,"categoryName":205,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":207,"categoryName":208,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":210,"categoryName":211,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":213,"categoryName":214,"taxonomyType":161,"taxonomyTypeDesc":162},"01JBSEEDCAT000000000000036","内容创作者",[216,217,218,92,115,219,84,220,109,90,221],"writing","writing skills","new","work","editing","Existing"]