Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/air-gapped/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/air-gapped/skills/k8s)<a href="https://agentmods.dev/plugins/air-gapped/skills/k8s"><img src="https://agentmods.dev/badge/plugins/air-gapped/skills/k8s/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/air-gapped/skills/k8s"><img src="https://agentmods.dev/badge/plugins/air-gapped/skills/k8s.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
k8s scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
{
"name": "k8s",
"source": "./",
"description": "Kubernetes suite — Argo CD application authoring (GitOps Application/ApplicationSet manifests, sync policies, AppProjects), Helm chart authoring, KEDA event-driven autoscaling, Keycloak IAM (Operator + CRDs, realm/client configuration, OIDC/SAML integration, security hardening), OpenShift application packaging, and k8s-components-checker (cross-component compatibility registry for RKE2 community stacks — kubectl/helm/pluto cluster survey, structured verdict + pre-upgrade report wrapper, skill-improver freshen and operator floor-override flows; covers 19 components: RKE2, Rancher, Harvester, Cilium, Tetragon, cert-manager, Kyverno, KEDA, Argo CD, Harbor, Traefik, Rook, Ceph, OpenEBS, GitLab, ECK, Zalando postgres-operator, Grafana Mimir, NVIDIA GPU Operator), plus rancher-upgrade — community Rancher fleet upgrade methodology (KDM downstream support matrix, CAPI→Turtles migration, Fleet, air-gapped upgrade procedure, per-minor 2.11→2.14 runbook), companion to k8s-components-checker. Harvester HCI upgrades live in the separate `harvester` suite. Also traefik-hardening — cap abusive/unwanted traffic at a Traefik 2.x/3.x ingress (per-identity rate + concurrency limiting, IPAllowList, buffering, middleware chaining, JWT-claim/header keying, air-gapped plugin loading, detection/response) on the principle of capping per-identity resource use rather than trying to classify good vs bad clients. Also postgres-operator-cloudnative-pg-migration — migrate PostgreSQL clusters off the Zalando postgres-operator (Spilo/Patroni) onto CloudNativePG: the glibc/collation and WAL-G↔Barman walls, three migration paths (logical replication default), full acid.zalan.do→Cluster manifest field map, barman-cloud plugin backup re-plumbing, consumer cutover, air-gap mirroring.",
"version": "0.20261013.205",
"author": {
"name": "Jörgen"
},
"license": "MIT",
"skills": [
"./.claude/skills/argo-cd-apps",
"./.claude/skills/heWhat it installs
The manifest is a name and a version. 9 skills travel with it, and installing the plugin installs all of them — 1,476 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill argo-cd-apps A 237 tokens
- Skill k8s-components-checker A 209 tokens
- Skill keda A 116 tokens
- Skill rancher-upgrade A 217 tokens
- Skill helm A 104 tokens
- Skill openshift-app A 143 tokens
- Skill postgres-operator-cloudnative-pg-migration A 224 tokens
- Skill traefik-hardening A 132 tokens
- Skill keycloak-iam B 94 tokens
What ships with it
1 file beside marketplace.json#k8s in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed 7626505241f5
- 11d ago Changed fda42856b373
- 19d ago Changed 0451ba9db22d
- 29d ago Changed 7cb0357e075d
- 1mo ago Changed 120aee8ae721
- 1mo ago Changed 0435f44c825c
- 1mo ago Changed 8f4d703d19d0
- 1mo ago First seen · 60 lines scan A 44bfbbf0f678
k8s is a plugin published in the GitHub repository air-gapped/skills (5 stars, last pushed 4d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other plugins, from other repositories
infra-plugin
Infrastructure management for Kubernetes/GKE, Istio service mesh, and authentication (Keycloak, OAuth2-proxy). Includes Helm charts, Terraform IaC, and Traefik reverse proxy.
sre-bot
SRE triage assistant for plain-English production health and Kubernetes questions in Slack. One pinned upstream Kubernetes MCP connector exposes the core toolset: reads execute immediately, six mutations require a fresh human approval, and unmatched tools fail closed. Kubernetes RBAC limits writes to disposable…
issue-to-pr
Take a GitHub issue (bare, or tracked on a Project board) from triage to a merge-ready PR through a gated, worktree-isolated pipeline that scales its depth to the task and asks at most one batched question. The gates hold every run: design hardening, tests green, code review clean. Once you approve the PR in-session…
claude-md-slim
Shrink an oversized or stale CLAUDE.md by moving subsystem detail into path-scoped .claude/rules/ files, with scripts that measure the loaded size against the documented 200-line budget and prove the extraction lost nothing.
unity-dev
Unity C# development workflow with architecture design, coding guidelines, testing patterns, and specialized review agents.
gitops-kubernetes
Flux CD debugging, knowledge, and tenant onboarding — skills plus the Flux MCP server and a read-only Flux troubleshooter agent for live-cluster debugging.