Skills for Real Engineers. Straight from my .agents directory.
39 skills
offensive-k8s-attacks
Agent skill from
Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service account token theft and impersonation, RBAC misconfiguration exploitation including wildcard permissions and privilege escalation via role binding, direct etcd access for secret extraction, kubelet API abuse on port 10250 and read-only port 10255, pod escape via hostPID hostNetwork and hostPath volume mounts, Kubernetes secrets enumeration and decoding, admission controller bypass techniques, network policy bypass and lateral movement, cloud metadata service access from pods for credential theft on AWS EKS GCP GKE and Azure AKS, CRD and operator abuse for persistence, and node compromise via DaemonSet deployment. Tools include kubectl, kube-hunter, peirates, kubeaudit, kdigger, kubeletctl. Maps to MITRE ATT&CK T1609 Container Administration Command, T1610 Deploy Container, T1613 Container and Resource Discovery. Use this skill when assessing
How to install offensive-k8s-attacks
install offensive-k8s-attacks
# install the Claude-Red pack with the skills CLI
npx skills add SnailSploit/Claude-Red# or add only this skill to Claude Code: copy the folder
Skills/container/offensive-k8s-attacks/
# into
~/.claude/skills/offensive-k8s-attacks/ (all projects)
.claude/skills/offensive-k8s-attacks/ (one project)
1# Kubernetes Cluster Attacks23You have access to a Kubernetes environment, either through a compromised pod, stolen kubeconfig, or exposed API server. Your objective is to escalate privileges, move laterally, and compromise the cluster or underlying cloud infrastructure. Kubernetes security depends on RBAC policies, network policies, admission controllers, pod security standards, and cloud IAM integration. Each misconfiguration opens a path to deeper access. This skill covers systematic enumeration, privilege escalation, secret extraction, and cluster-wide compromise techniques.45## Quick Workflow671. Determine your initial position: pod shell, stolen token, exposed API, or kubeconfig file.82. Enumerate service account permissions, cluster roles, and accessible resources.93. Identify escalation vectors: RBAC gaps, kubelet exposure, hostPath mounts, cloud metadata access.104. Escalate privileges by chaining misconfigurations or abusing overprivileged service accounts.115. Extract secrets, pivot to other namespaces, and target the control plane.126. Leverage cloud metadata or etcd access for infrastructure-wide compromise.1314---1516## Phase 1: Initial Enumeration1718### Determining Your Position1920```bash21# Check if you are inside a pod22ls /var/run/secrets/kubernetes.io/serviceaccount/ 2>/dev/null23cat /var/run/secrets/kubernetes.io/serviceaccount/token24cat /var/run/secrets/kubernetes.io/serviceaccount/namespace25cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt26…
Excerpt shown under the repository's MIT license.
More skills in Claude-Red
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills
Production-grade engineering skills for AI coding agents.
CCCXCU25 skills