[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7D83Y8ATDBMSS68QEYMPPYV":3,"skill-same:01M7D83Y8ATDBMSS68QEYMPPYV":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":59,"ownerDescription":60,"updatedAt":61,"install":62,"resources":75},"01M7D83Y8ATDBMSS68QEYMPPYV","detecting-privilege-escalation-in-kubernetes-pods",null,"Detect and prevent privilege escalation in Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when hardening pod security policies, investigating a pod running as root or privileged, or hunting for containers escaping their intended scope.","SaiVatsal\u002FSkills-I-Use","SaiVatsal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F242597752?v=4","01M7D5YM1T4VXW9203M0GFAHZ1","SaiVatsalPolimera","01M7D5YM2D61ST39XVR2V7B7ZJ",3,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: detecting-privilege-escalation-in-kubernetes-pods\ndescription: Detect and prevent privilege escalation in Kubernetes pods by combining\n  admission control (OPA policies), runtime monitoring (Falco), and audit log\n  analysis of security contexts, Linux capabilities, and syscall patterns. Use\n  when hardening pod security policies, investigating a pod running as root or\n  privileged, or hunting for containers escaping their intended scope.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- kubernetes\n- privilege-escalation\n- security-context\n- capabilities\n- detection\n- pod-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Restore Access\n- Password Authentication\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n- T1068\n---\n\n# Detecting Privilege Escalation in Kubernetes Pods\n\n## Overview\n\nPrivilege escalation in Kubernetes occurs when a pod or container gains elevated permissions beyond its intended scope. This includes running as root, using privileged mode, mounting host filesystems, enabling dangerous Linux capabilities, or exploiting kernel vulnerabilities. Detection combines admission control (prevention), runtime monitoring (detection), and audit logging (investigation).\n\n\n## When to Use\n\n- When investigating security incidents that require detecting privilege escalation in kubernetes pods\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Kubernetes cluster v1.25+ (Pod Security Admission support)\n- kubectl with cluster-admin access\n- Falco or similar runtime security tool\n- OPA Gatekeeper or Kyverno for admission policies\n\n## Privilege Escalation Vectors in Kubernetes\n\n| Vector | Risk | Detection Method |\n|--------|------|-----------------|\n| privileged: true | Full host access | Admission control + audit |\n| hostPID: true | Access host processes | Admission control |\n| hostNetwork: true | Access host network stack | Admission control |\n| hostPath volumes | Read\u002Fwrite host filesystem | Admission control |\n| SYS_ADMIN capability | Near-privileged access | Admission + runtime |\n| allowPrivilegeEscalation: true | setuid\u002Fsetgid exploitation | Admission control |\n| runAsUser: 0 | Container root | Admission control |\n| automountServiceAccountToken | Token theft for API access | Admission control |\n| Writable \u002Fproc or \u002Fsys | Kernel parameter manipulation | Runtime monitoring |\n\n## Detection with Admission Control\n\n### Pod Security Admission (Built-in)\n\n```yaml\n# Enforce restricted policy on namespace\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Fwarn: restricted\n```\n\n### OPA Gatekeeper Policies\n\n```yaml\n# Block dangerous capabilities\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sdangerouspriv\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sDangerousPriv\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sdangerouspriv\n\n        dangerous_caps := {\"SYS_ADMIN\", \"SYS_PTRACE\", \"SYS_MODULE\", \"DAC_OVERRIDE\", \"NET_ADMIN\", \"NET_RAW\"}\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          cap := container.securityContext.capabilities.add[_]\n          dangerous_caps[cap]\n          msg := sprintf(\"Container %v adds dangerous capability: %v\", [container.name, cap])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Container %v runs in privileged mode\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.allowPrivilegeEscalation == true\n          msg := sprintf(\"Container %v allows privilege escalation\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          input.review.object.spec.hostPID == true\n          msg := \"Pod uses host PID namespace\"\n        }\n\n        violation[{\"msg\": msg}] {\n          input.review.object.spec.hostNetwork == true\n          msg := \"Pod uses host network\"\n        }\n```\n\n## Runtime Detection with Falco\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fprivesc-detection.yaml\n- rule: Setuid Binary Execution in Container\n  desc: Detect execution of setuid\u002Fsetgid binaries in a container\n  condition: >\n    spawned_process and container and\n    (proc.name in (su, sudo, newgrp, chsh, passwd) or\n     proc.is_exe_upper_layer=true)\n  output: >\n    Setuid\u002Fsetgid binary executed in container\n    (user=%user.name container=%container.name image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname)\n  priority: WARNING\n  tags: [container, privilege-escalation, T1548]\n\n- rule: Capability Gained in Container\n  desc: Detect when a process gains elevated capabilities\n  condition: >\n    evt.type = capset and container and\n    evt.arg.cap != \"\"\n  output: >\n    Process gained capabilities in container\n    (container=%container.name image=%container.image.repository\n     capabilities=%evt.arg.cap command=%proc.cmdline)\n  priority: WARNING\n  tags: [container, privilege-escalation, T1548.001]\n\n- rule: Container with Dangerous Capabilities Started\n  desc: Detect container launched with dangerous capabilities\n  condition: >\n    container_started and container and\n    (container.image.repository != \"registry.k8s.io\u002Fpause\") and\n    (container.cap_effective contains SYS_ADMIN or\n     container.cap_effective contains SYS_PTRACE or\n     container.cap_effective contains SYS_MODULE)\n  output: >\n    Container with dangerous capabilities\n    (container=%container.name image=%container.image.repository\n     caps=%container.cap_effective)\n  priority: CRITICAL\n  tags: [container, privilege-escalation, T1068]\n\n- rule: Write to \u002Fetc\u002Fpasswd in Container\n  desc: Detect writes to \u002Fetc\u002Fpasswd inside container\n  condition: >\n    open_write and container and fd.name = \u002Fetc\u002Fpasswd\n  output: >\n    Write to \u002Fetc\u002Fpasswd in container\n    (container=%container.name image=%container.image.repository\n     command=%proc.cmdline user=%user.name)\n  priority: CRITICAL\n  tags: [container, privilege-escalation, T1136]\n```\n\n## Kubernetes Audit Log Detection\n\n```yaml\n# audit-policy.yaml - Capture privilege escalation events\napiVersion: audit.k8s.io\u002Fv1\nkind: Policy\nrules:\n  # Log pod creation with security context details\n  - level: RequestResponse\n    resources:\n      - group: \"\"\n        resources: [\"pods\"]\n    verbs: [\"create\", \"update\", \"patch\"]\n\n  # Log privilege escalation attempts\n  - level: RequestResponse\n    resources:\n      - group: \"rbac.authorization.k8s.io\"\n        resources: [\"clusterroles\", \"clusterrolebindings\", \"roles\", \"rolebindings\"]\n    verbs: [\"create\", \"update\", \"patch\", \"bind\", \"escalate\"]\n\n  # Log service account token requests\n  - level: Metadata\n    resources:\n      - group: \"\"\n        resources: [\"serviceaccounts\u002Ftoken\"]\n    verbs: [\"create\"]\n```\n\n### Query Audit Logs for Privilege Escalation\n\n```bash\n# Find pods created with privileged security context\nkubectl logs -n kube-system kube-apiserver-* | \\\n  jq 'select(.verb == \"create\" and .objectRef.resource == \"pods\") |\n  select(.requestObject.spec.containers[].securityContext.privileged == true)'\n\n# Find RBAC escalation attempts\nkubectl logs -n kube-system kube-apiserver-* | \\\n  jq 'select(.objectRef.resource == \"clusterrolebindings\" and .verb == \"create\")'\n```\n\n## Investigation Playbook\n\n```bash\n# Check pod security context\nkubectl get pod \u003Cpod-name> -n \u003Cns> -o jsonpath='{.spec.containers[*].securityContext}'\n\n# Check effective capabilities\nkubectl exec \u003Cpod-name> -n \u003Cns> -- cat \u002Fproc\u002F1\u002Fstatus | grep -i cap\n\n# List pods running as root\nkubectl get pods --all-namespaces -o json | \\\n  jq '.items[] | select(.spec.containers[].securityContext.runAsUser == 0 or .spec.containers[].securityContext.privileged == true) | {name: .metadata.name, ns: .metadata.namespace}'\n\n# Check for hostPath volumes\nkubectl get pods --all-namespaces -o json | \\\n  jq '.items[] | select(.spec.volumes[]?.hostPath != null) | {name: .metadata.name, ns: .metadata.namespace, paths: [.spec.volumes[].hostPath.path]}'\n```\n\n## Best Practices\n\n1. **Enable Pod Security Admission** at `restricted` level for production namespaces\n2. **Drop ALL capabilities** and add back only what is needed\n3. **Set allowPrivilegeEscalation: false** on all containers\n4. **Run as non-root** (runAsNonRoot: true, runAsUser > 0)\n5. **Disable automountServiceAccountToken** unless API access is needed\n6. **Monitor with Falco** for runtime privilege escalation attempts\n7. **Audit RBAC changes** with Kubernetes audit logging\n8. **Use seccomp profiles** to restrict syscalls\n","# Detecting Privilege Escalation in Kubernetes Pods\n\n## Overview\n\nPrivilege escalation in Kubernetes occurs when a pod or container gains elevated permissions beyond its intended scope. This includes running as root, using privileged mode, mounting host filesystems, enabling dangerous Linux capabilities, or exploiting kernel vulnerabilities. Detection combines admission control (prevention), runtime monitoring (detection), and audit logging (investigation).\n\n\n## When to Use\n\n- When investigating security incidents that require detecting privilege escalation in kubernetes pods\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Kubernetes cluster v1.25+ (Pod Security Admission support)\n- kubectl with cluster-admin access\n- Falco or similar runtime security tool\n- OPA Gatekeeper or Kyverno for admission policies\n\n## Privilege Escalation Vectors in Kubernetes\n\n| Vector | Risk | Detection Method |\n|--------|------|-----------------|\n| privileged: true | Full host access | Admission control + audit |\n| hostPID: true | Access host processes | Admission control |\n| hostNetwork: true | Access host network stack | Admission control |\n| hostPath volumes | Read\u002Fwrite host filesystem | Admission control |\n| SYS_ADMIN capability | Near-privileged access | Admission + runtime |\n| allowPrivilegeEscalation: true | setuid\u002Fsetgid exploitation | Admission control |\n| runAsUser: 0 | Container root | Admission control |\n| automountServiceAccountToken | Token theft for API access | Admission control |\n| Writable \u002Fproc or \u002Fsys | Kernel parameter manipulation | Runtime monitoring |\n\n## Detection with Admission Control\n\n### Pod Security Admission (Built-in)\n\n```yaml\n# Enforce restricted policy on namespace\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Fenforce-version: latest\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Fwarn: restricted\n```\n\n### OPA Gatekeeper Policies\n\n```yaml\n# Block dangerous capabilities\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sdangerouspriv\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sDangerousPriv\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sdangerouspriv\n\n        dangerous_caps := {\"SYS_ADMIN\", \"SYS_PTRACE\", \"SYS_MODULE\", \"DAC_OVERRIDE\", \"NET_ADMIN\", \"NET_RAW\"}\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          cap := container.securityContext.capabilities.add[_]\n          dangerous_caps[cap]\n          msg := sprintf(\"Container %v adds dangerous capability: %v\", [container.name, cap])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Container %v runs in privileged mode\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.allowPrivilegeEscalation == true\n          msg := sprintf(\"Container %v allows privilege escalation\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          input.review.object.spec.hostPID == true\n          msg := \"Pod uses host PID namespace\"\n        }\n\n        violation[{\"msg\": msg}] {\n          input.review.object.spec.hostNetwork == true\n          msg := \"Pod uses host network\"\n        }\n```\n\n## Runtime Detection with Falco\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fprivesc-detection.yaml\n- rule: Setuid Binary Execution in Container\n  desc: Detect execution of setuid\u002Fsetgid binaries in a container\n  condition: >\n    spawned_process and container and\n    (proc.name in (su, sudo, newgrp, chsh, passwd) or\n     proc.is_exe_upper_layer=true)\n  output: >\n    Setuid\u002Fsetgid binary executed in container\n    (user=%user.name container=%container.name image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname)\n  priority: WARNING\n  tags: [container, privilege-escalation, T1548]\n\n- rule: Capability Gained in Container\n  desc: Detect when a process gains elevated capabilities\n  condition: >\n    evt.type = capset and container and\n    evt.arg.cap != \"\"\n  output: >\n    Process gained capabilities in container\n    (container=%container.name image=%container.image.repository\n     capabilities=%evt.arg.cap command=%proc.cmdline)\n  priority: WARNING\n  tags: [container, privilege-escalation, T1548.001]\n\n- rule: Container with Dangerous Capabilities Started\n  desc: Detect container launched with dangerous capabilities\n  condition: >\n    container_started and container and\n    (container.image.repository != \"registry.k8s.io\u002Fpause\") and\n    (container.cap_effective contains SYS_ADMIN or\n     container.cap_effective contains SYS_PTRACE or\n     container.cap_effective contains SYS_MODULE)\n  output: >\n    Container with dangerous capabilities\n    (container=%container.name image=%container.image.repository\n     caps=%container.cap_effective)\n  priority: CRITICAL\n  tags: [container, privilege-escalation, T1068]\n\n- rule: Write to \u002Fetc\u002Fpasswd in Container\n  desc: Detect writes to \u002Fetc\u002Fpasswd inside container\n  condition: >\n    open_write and container and fd.name = \u002Fetc\u002Fpasswd\n  output: >\n    Write to \u002Fetc\u002Fpasswd in container\n    (container=%container.name image=%container.image.repository\n     command=%proc.cmdline user=%user.name)\n  priority: CRITICAL\n  tags: [container, privilege-escalation, T1136]\n```\n\n## Kubernetes Audit Log Detection\n\n```yaml\n# audit-policy.yaml - Capture privilege escalation events\napiVersion: audit.k8s.io\u002Fv1\nkind: Policy\nrules:\n  # Log pod creation with security context details\n  - level: RequestResponse\n    resources:\n      - group: \"\"\n        resources: [\"pods\"]\n    verbs: [\"create\", \"update\", \"patch\"]\n\n  # Log privilege escalation attempts\n  - level: RequestResponse\n    resources:\n      - group: \"rbac.authorization.k8s.io\"\n        resources: [\"clusterroles\", \"clusterrolebindings\", \"roles\", \"rolebindings\"]\n    verbs: [\"create\", \"update\", \"patch\", \"bind\", \"escalate\"]\n\n  # Log service account token requests\n  - level: Metadata\n    resources:\n      - group: \"\"\n        resources: [\"serviceaccounts\u002Ftoken\"]\n    verbs: [\"create\"]\n```\n\n### Query Audit Logs for Privilege Escalation\n\n```bash\n# Find pods created with privileged security context\nkubectl logs -n kube-system kube-apiserver-* | \\\n  jq 'select(.verb == \"create\" and .objectRef.resource == \"pods\") |\n  select(.requestObject.spec.containers[].securityContext.privileged == true)'\n\n# Find RBAC escalation attempts\nkubectl logs -n kube-system kube-apiserver-* | \\\n  jq 'select(.objectRef.resource == \"clusterrolebindings\" and .verb == \"create\")'\n```\n\n## Investigation Playbook\n\n```bash\n# Check pod security context\nkubectl get pod \u003Cpod-name> -n \u003Cns> -o jsonpath='{.spec.containers[*].securityContext}'\n\n# Check effective capabilities\nkubectl exec \u003Cpod-name> -n \u003Cns> -- cat \u002Fproc\u002F1\u002Fstatus | grep -i cap\n\n# List pods running as root\nkubectl get pods --all-namespaces -o json | \\\n  jq '.items[] | select(.spec.containers[].securityContext.runAsUser == 0 or .spec.containers[].securityContext.privileged == true) | {name: .metadata.name, ns: .metadata.namespace}'\n\n# Check for hostPath volumes\nkubectl get pods --all-namespaces -o json | \\\n  jq '.items[] | select(.spec.volumes[]?.hostPath != null) | {name: .metadata.name, ns: .metadata.namespace, paths: [.spec.volumes[].hostPath.path]}'\n```\n\n## Best Practices\n\n1. **Enable Pod Security Admission** at `restricted` level for production namespaces\n2. **Drop ALL capabilities** and add back only what is needed\n3. **Set allowPrivilegeEscalation: false** on all containers\n4. **Run as non-root** (runAsNonRoot: true, runAsUser > 0)\n5. **Disable automountServiceAccountToken** unless API access is needed\n6. **Monitor with Falco** for runtime privilege escalation attempts\n7. **Audit RBAC changes** with Kubernetes audit logging\n8. **Use seccomp profiles** to restrict syscalls\n",{"name":5,"tags":25,"author":32,"domain":33,"license":15,"version":34,"nist_csf":35,"subdomain":40,"description":7,"mitre_attack":41,"d3fend_techniques":47},[26,27,28,29,30,31],"kubernetes","privilege-escalation","security-context","capabilities","detection","pod-security","mahipal","cybersecurity","1.0",[36,37,38,39],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01","container-security",[42,43,44,45,46],"T1610","T1611","T1609","T1525","T1068",[48,49,50,51,52],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication","main","8a3b3de73262a4c4db64523949360f3c599c2fb1","Anthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods",0,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use","https:\u002F\u002Fgithub.com\u002FSaiVatsal","https:\u002F\u002Fsaivatsal.github.io\u002FPortfolio\u002F","The Longer It Takes The Stronger It Becomes ","2026-09-21 22:45:58",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add SaiVatsal\u002FSkills-I-Use --skill detecting-privilege-escalation-in-kubernetes-pods",{"tool":68,"command":69},"bunx","bunx skills add SaiVatsal\u002FSkills-I-Use --skill detecting-privilege-escalation-in-kubernetes-pods",{"tool":71,"command":72},"pnpm","pnpm dlx skills add SaiVatsal\u002FSkills-I-Use --skill detecting-privilege-escalation-in-kubernetes-pods","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002FSKILL.md",true,[76,82,86,92,96,100,106],{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"assets\u002Ftemplate.md","ASSET","资产文件",1064,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002Fassets\u002Ftemplate.md",{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",1220,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fstandards.md",1066,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002Freferences\u002Fstandards.md",{"path":97,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fworkflows.md",1200,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002Freferences\u002Fworkflows.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",4301,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002Fscripts\u002Fagent.py",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fprocess.py",5406,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fdetecting-privilege-escalation-in-kubernetes-pods\u002Fscripts\u002Fprocess.py",[111,119,127,136,143,150],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":115,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":20},"01M7DJZP6E6KMBQV4CZSDPZEZ8","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fwebapp-testing\u002FSKILL.md",[],[],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":123,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":20},"01M7DJZFTS5TS06K2TV3MDTE67","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fweb-artifacts-builder\u002FSKILL.md",[],[],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":132,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":20},"01M7DJRK4SRQ908F2TJM6EZ7EV","ui-styling","Create beautiful, accessible user interfaces with shadcn\u002Fui components (built on Radix UI + Tailwind), Tailwind CSS utility-first styling, and canvas-based visual designs. Use when building user interfaces, implementing design systems, creating responsive layouts, adding accessible components (dialogs, dropdowns, forms, tables), customizing themes and colors, implementing dark mode, generating visual designs and posters, or establishing consistent styling patterns across applications.","MIT","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fui-styling\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fui-styling\u002FSKILL.md",[],[],{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":20},"01M7DJR902059VEQP23PVM2WA0","design","Comprehensive design skill: brand identity, design tokens, UI styling, logo generation (55 styles, Gemini AI), corporate identity program (50 deliverables, CIP mockups), HTML presentations (Chart.js), banner design (22 styles, social\u002Fads\u002Fweb\u002Fprint), icon design (15 styles, SVG, Gemini 3.1 Pro), social photos (HTML→screenshot, multi-platform). Actions: design logo, create CIP, generate mockups, build slides, design banner, generate icon, create social photos, social media images, brand identity, design system. Platforms: Facebook, Twitter, LinkedIn, YouTube, Instagram, Pinterest, TikTok, Threads, Google Ads.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fdesign\u002FSKILL.md",[],[],{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":20},"01M7DJR56QF5N6XYTCPCFHFMNP","design-system","Token architecture, component specifications, and slide generation. Three-layer tokens (primitive→semantic→component), CSS variables, spacing\u002Ftypography scales, component specs, strategic slide creation. Use for design tokens, systematic design, brand-compliant presentations.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fdesign-system\u002FSKILL.md",[],[],{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":131,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":20},"01M7DJQXB6M0SFF7NX8J5N01AH","banner-design","Design banners for social media, ads, website heroes, creative assets, and print. Multiple art direction options with AI-generated visuals. Actions: design, create, generate banner. Platforms: Facebook, Twitter\u002FX, LinkedIn, YouTube, Instagram, Google Display, website hero, print. Styles: minimalist, gradient, bold typography, photo-based, illustrated, geometric, retro, glassmorphism, 3D, neon, duotone, editorial, collage. Uses ui-ux-pro-max, frontend-design, ai-artist, ai-multimodal skills.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fbanner-design\u002FSKILL.md",[],[]]