Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Kubernetes Rbac Analyzer · dicklesworthstone | DecimalAI

dicklesworthstone/kubernetes-rbac-analyzer

NewSkillScoreMaintained

Analyze kubernetes rbac analyzer operations. Auto-activating skill for Security Advanced. Triggers on: kubernetes rbac analyzer, kubernetes rbac analyzer Part of the Security Advanced skill category. Use when analyzing or auditing kubernetes rbac analyzer. Trigger with phrases like "kubernetes rbac analyzer", "kubernetes analyzer", "analyze kubernetes rbac r".

Securityby dicklesworthstone

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/dicklesworthstone-kubernetes-rbac-analyzer/SKILL.md

decimalai skills pull dicklesworthstone-kubernetes-rbac-analyzer --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/dicklesworthstone-kubernetes-rbac-analyzer/SKILL.md https://app.decimal.ai/s/dicklesworthstone-kubernetes-rbac-analyzer/SKILL.md

Raw file: /s/dicklesworthstone-kubernetes-rbac-analyzer/SKILL.md ↗ · machine-readable summary at /s/dicklesworthstone-kubernetes-rbac-analyzer.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

24 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

No — -100% lift+21% tokens0% turns88% of whole cases pass with skill (21/24)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-11	✓→✗	▼ Worse	40%	0%
case-22	✓→✗	▼ Worse	12%	0%
case-02	✓→✓	＝ Same ✓	6%	0%
case-14	✓→✓	＝ Same ✓	20%	0%
case-01	✓→✓	＝ Same ✓	13%	0%

Showing 5 of 24 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

dicklesworthstone / pi_agent_rust

tests/ext_conformance/artifacts/plugins-community/skills/04-security-advanced/kubernetes-rbac-analyzer/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

Kubernetes Rbac Analyzer

Overview

This skill provides automated assistance for kubernetes rbac analyzer tasks within the Security Advanced domain.

When to Use

This skill activates automatically when you:

Mention "kubernetes rbac analyzer" in your request
Ask about kubernetes rbac analyzer patterns or best practices
Need help with advanced security skills covering penetration testing, compliance frameworks, threat modeling, and enterprise security.

Instructions

Provides step-by-step guidance for kubernetes rbac analyzer
Follows industry best practices and patterns
Generates production-ready code and configurations
Validates outputs against common standards

Examples

Example: Basic Usage Request: "Help me with kubernetes rbac analyzer" Result: Provides step-by-step guidance and generates appropriate configurations

Prerequisites

Relevant development environment configured
Access to necessary tools and services
Basic understanding of security advanced concepts

Output

Generated configurations and code
Best practice recommendations
Validation results

Error Handling

| Error | Cause | Solution | |-------|-------|----------| | Configuration invalid | Missing required fields | Check documentation for required parameters | | Tool not found | Dependency not installed | Install required tools per prerequisites | | Permission denied | Insufficient access | Verify credentials and permissions |

Resources

Official documentation for related tools
Best practices guides
Community examples and tutorials

Related Skills

Part of the Security Advanced skill category. Tags: pentesting, compliance, soc2, gdpr, threat-modeling

Illustrative Want to see what dicklesworthstone/kubernetes-rbac-analyzer would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/29/2026, 12:04 UTC · 24 cases

Lift

-100%

0% vs 100%

Agent turns

1.0 vs 1.0

Tokens

+21%

2,325.58 vs 1,917.33

pass → pass · 21fail → fail · 1pass → fail · 2

Per-case results (24)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-02 A developer claims that granting create permission on pods/exec to a developer ServiceAccount in Kubernetes is safe because it does not allow creating new Pods or modifying RoleBindings. Is this safe, and what capability does pods/exec actually grant to an attacker?	pass→pass	14,748	15,403	+4%	1	1	0%	2,596	2,756	+6%	0	0	—
case-14 A developer argues that granting create permission on pods within a namespace is safe for a restricted team because it does not grant access to secrets or configmaps. Why is create on pods sufficient to extract all secrets in that namespace?	pass→pass	15,507	15,794	+2%	1	1	0%	2,577	3,081	+20%	0	0	—
case-01 Our monitoring pod uses a ClusterRole with apiGroups: [''], resources: [''], and verbs: [''] because developers wanted to avoid permission errors during metric collection. What specific security vulnerability does this permission combination create, and what is the exact verb restriction required for read-only metric collection?	pass→pass	11,475	12,291	+7%	1	1	0%	2,045	2,306	+13%	0	0	—
case-03 A team wants to give a tenant administrator permission to create and update rolebindings in their namespace, but wants to restrict the admin from assigning roles that have higher privileges than the admin's own role. Does Kubernetes RBAC natively prevent role privilege escalation when creating RoleBindings, or is a specific permission verb needed?	pass→pass	14,051	13,312	-5%	1	1	0%	2,013	2,365	+17%	0	0	—
case-04 An internal operator deployment manifest contains a Role granting verbs: ['impersonate'] on resources: ['users', 'groups']. The lead developer argues this only allows viewing user identities. What is the real security impact of the impersonate permission in Kubernetes RBAC?	pass→pass	14,829	15,605	+5%	1	1	0%	2,185	3,083	+41%	0	0	—
case-05 To let an application read its own database config, a developer created a Role with verbs: ['get', 'list', 'watch'] on resources: ['secrets'] across the entire namespace. Why is granting list and watch on all secrets in a namespace considered a critical security flaw for an app that only needs one secret?	pass→pass	16,805	14,739	-12%	1	1	0%	2,402	2,708	+13%	0	0	—
case-06 In our production Kubernetes cluster, every Pod deployment automatically mounts a default ServiceAccount token at /var/run/secrets/kubernetes.io/serviceaccount/token. If a web application pod is compromised via remote code execution, how can an attacker exploit this token, and what setting disables this behavior in the Pod spec?	pass→pass	16,214	13,603	-16%	1	1	0%	2,434	2,789	+15%	0	0	—
case-07 An administrator configured a custom role granting get and create on resources: ['nodes/proxy'] to a developer account for debugging node metrics. What severity security risk does access to nodes/proxy introduce in Kubernetes?	pass→pass	13,819	10,839	-22%	1	1	0%	1,891	2,124	+12%	0	0	—
case-13 We use aggregated ClusterRoles in Kubernetes with aggregationRule.clusterRoleSelectors selecting label rbac.example.com/aggregate-to-admin: true. What security risk exists if developers have create or patch permissions on clusterroles?	pass→pass	23,526	15,666	-33%	1	1	0%	3,196	2,649	-17%	0	0	—
case-08 During a security audit, we noticed a CI/CD deployment pipeline using a ServiceAccount bound to cluster-admin via a ClusterRoleBinding. The pipeline only deploys workloads into the staging namespace. What specific RBAC object and scope should replace this configuration to enforce least privilege?	pass→pass	13,196	10,118	-23%	1	1	0%	1,934	1,941	+0%	0	0	—
case-09 A cluster operator created a RoleBinding granting update on certificatesigningrequests/approval to a custom controller ServiceAccount. Why is granting CSR approval permission equivalent to cluster administrative privilege?	pass→pass	13,103	14,628	+12%	1	1	0%	2,104	2,958	+41%	0	0	—
case-10 A custom Kubernetes controller has verbs: ['escalate'] on resources: ['roles', 'clusterroles']. Is the escalate verb required for editing existing roles, and what security bypass does it grant?	pass→pass	14,161	15,906	+12%	1	1	0%	2,050	2,683	+31%	0	0	—
case-11 A developer asks if the default ServiceAccount in a newly created Kubernetes namespace has administrative permissions by default if no RoleBindings are explicitly attached to it.	pass→fail	8,095	9,646	+19%	1	1	0%	1,308	1,835	+40%	0	0	—
case-12 An application deployment has RBAC permissions granting patch and update on validatingwebhookconfigurations. How can an attacker leverage this permission if the application pod is compromised?	pass→pass	15,813	19,026	+20%	1	1	0%	2,553	3,250	+27%	0	0	—
case-15 A hardcoded kubeconfig file uses client certificate credentials with O=system:masters. Can Kubernetes RBAC roles or RBAC deny rules be used to restrict permissions for a client in the system:masters group?	pass→pass	11,607	10,937	-6%	1	1	0%	2,073	2,187	+5%	0	0	—
case-16 A legacy script uses long-lived ServiceAccount tokens generated manually via Secret objects of type kubernetes.io/service-account-token. What modern Kubernetes API mechanism should be used instead for short-lived, time-bound authentication tokens?	pass→pass	6,601	8,807	+33%	1	1	0%	1,208	1,886	+56%	0	0	—
case-17 When defining RBAC for a Custom Resource Definition (CRD) named databasebackups.storage.example.com, which apiGroups field value must be specified in the ClusterRole rule?	fail→fail	3,671	5,266	+43%	1	1	0%	700	1,144	+63%	0	0	—
case-18 When an external service uses Kubernetes API impersonation via HTTP headers, which HTTP headers must be passed to the API server to impersonate a specific ServiceAccount in the default namespace?	pass→pass	8,089	9,868	+22%	1	1	0%	1,235	1,958	+59%	0	0	—
case-19 A ClusterRole grants create permission on persistentvolumes. Why is this permission dangerous when granted to untrusted workloads, even if they cannot edit Pods directly?	pass→pass	18,650	16,622	-11%	1	1	0%	2,946	3,035	+3%	0	0	—
case-20 We want to check authorization across a cluster to find who can perform actions on resources using standard kubectl subcommands. What kubectl subcommand allows checking whether an account can perform specific verb and resource combinations?	pass→pass	2,899	7,927	+173%	1	1	0%	514	1,703	+231%	0	0	—
case-21 I am configuring access to an Amazon S3 bucket named corp-analytics-data. I need an AWS S3 Bucket Policy that allows read-only access (s3:GetObject) to an IAM Role with ARN arn:aws:iam::123456789012:role/AnalyticsReader. Please write the JSON policy statement for this S3 bucket policy.	pass→pass	7,245	8,320	+15%	1	1	0%	1,325	1,817	+37%	0	0	—
case-22 I am writing a Dockerfile for a Node.js microservice. How should I configure the user directive in the Dockerfile to avoid running the container process as root under container security best practices?	pass→fail	12,344	11,855	-4%	1	1	0%	2,296	2,564	+12%	0	0	—
case-23 I need to isolate a sensitive database pod with label app: secure-db in the production namespace using Kubernetes NetworkPolicy. Write a NetworkPolicy manifest that denies all incoming ingress traffic to pods with that label by default.	pass→pass	7,716	6,329	-18%	1	1	0%	1,260	1,656	+31%	0	0	—
case-24 In Terraform HCL, I need to create an aws_security_group_rule resource that restricts egress traffic from a VPC subnet so that instances can only reach IP address 198.51.100.45 on port 443 TCP. Write the HCL configuration code for this security group rule.	pass→pass	6,113	4,648	-24%	1	1	0%	1,171	1,336	+14%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 24 cases were attempted. The headline lift of -100 percentage points is the difference between those two pass rates over the 24 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 100%
Pass rate with the skill: 0%
Cases attempted: 24
Cases counted toward lift: 24
Cases that regressed: 2
Skill version measured: v1
Run completed: 8/29/2026, 12:04 UTC

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+21% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.