devopsby automateyournetwork
Kubeshark Kubernetes Traffic Analysis
automateyournetwork/kubeshark-traffic
Kubeshark Kubernetes traffic analysis — L4/L7 deep packet inspection, TLS decryption, pcap export, flow analysis, service mapping (6 tools).
What it changes
Passed 21 of 21 test cases with the skill, and 7 of 21 without it.
Without skill32%
With skill100%
Checks it passed that the model alone missed
- Recommends list_l4_flows.
- Recommends get_l4_flow_summary.
- Uses export_pcap to produce a trace file.
and 20 more in the full report
15 fixed7 passed either way0 still failing0 broke
- Pass-rate lift
- +68 pp
- Tokens
- +62%
- Agent turns
- 0%
- Response time
- -47%
Model gemini-3.6-flashMeasured 8/16/2026v122 of 22 cases passed with skill · 21 comparable
See it in action
One of 14 test cases the skill fixed. Same model, same prompt, with and without the skill.
PromptWhich environment variable must be set to point an MCP client to a locally port-forwarded Kubeshark instance running on port 8898?
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| Specifies KUBESHARK_MCP_URL set to http://localhost:8898/mcp. | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md163 linessingle file
Kubeshark Kubernetes Traffic Analysis
MCP Server
How to Run
# Install Kubeshark with MCP enabled
helm install kubeshark kubeshark/kubeshark \
--set mcp.enabled=true \
--set mcp.port=8898
# Port-forward for local access (if not in-cluster)
kubectl port-forward svc/kubeshark-hub 8898:8898
# MCP endpoint is now available at:
# http://localhost:8898/mcp
Environment Variables
Tools
Track record
Benchmark
21 / 21
test cases passed, vs 7 / 21 without
Adoption
- Users
- 0
- Times used
- 0
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
Importedautomateyournetwork / netclaw
workspace/skills/kubeshark-traffic/SKILL.md
View on GitHub ↗License Apache-2.0Imported 8/3/2026Version v1