Azure/AKS-Skills is a collection of agent skills for operating Azure Kubernetes Service clusters after they are provisioned. It helps compatible coding agents investigate incidents, control costs, assess AKS Automatic readiness, run GPU and inference workloads, capture packet-level evidence, and design clusters. The catalogue entries provide the skills, MCP integration, and plugin configuration for these AKS operations.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Azure/AKS-Skills --skill aks-network-capturegit clone --depth 1 https://github.com/Azure/AKS-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/azure/aks-skills/aks-network-capture)<a href="https://agentmods.dev/skills/azure/aks-skills/aks-network-capture"><img src="https://agentmods.dev/badge/skills/azure/aks-skills/aks-network-capture/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/azure/aks-skills/aks-network-capture"><img src="https://agentmods.dev/badge/skills/azure/aks-skills/aks-network-capture.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.01728 |
| Opus 5 | $0.00076 | $0.00864 |
| Sonnet 5 | $0.00030 | $0.00346 |
| Haiku 4.5 | $0.00015 | $0.00173 |
Grade A, and why
aks-network-capture scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AKS Network Capture
Capture packet-level evidence on AKS when read-only diagnostics are inconclusive. Use this to prove where a packet is dropped — inside the pod, on the node, at an NSG, on a route, or at the Azure load balancer.
This is an escalation tool. For most networking symptoms (DNS, connectivity, ingress 502s), start with aks-troubleshooting; come here when you need a pcap or wire-level proof.
Safety model
Packet capture requires elevated node access, so these scripts are built to be safe by construction:
- No shell injection. User-supplied filters and targets are validated against strict allowlists, passed to
tcpdumpas a single trailing argument (never a shell string), and compile-checked in-pod withtcpdump -d. There is noeval. A negative regression test (evals/tests/aks-network-capture/injection.test.sh) proves malicious inputs are rejected. - Scoped access, not
privileged. Capture pods use onlyNET_ADMIN+NET_RAWwithhostNetwork. They mount only/var/log/aks-network-capturesfrom the node, never the node root, and never enablehostPID. - Pinned images. Capture Jobs use Microsoft Retina's network-tool image from Microsoft Container Registry, pinned by digest; no Docker Hub, no
:latest.
The live-cluster smoke test is manual and is not run in CI. Before relying on distributed capture in production, run
evals/tests/aks-network-capture/smoke-live-cluster.shagainst an AKS cluster you control; it uses an isolated namespace, generates bounded same-node DNS traffic, retrieves the exact run, decodes packet records, and verifies Kubernetes plus host-artifact cleanup.
Capture workflow
| Script | Purpose |
|---|---|
scripts/setup-capture-configmap.sh |
Deploy the fixed capture runner to a namespace (run once per namespace) |
scripts/create-capture.sh |
Start a bounded capture Job on the selected nodes/pods |
scripts/retrieve-captures.sh |
Pull capture bundles off the nodes and clean up |
scripts/generate-test-traffic.sh |
Drive test traffic from a pod's netns while capturing |
scripts/collect-azure-network-info.sh |
Collect the Azure-side network config for the cluster |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 97 lines · 151 tokens per session scan A 54766850a5e7
aks-network-capture is a skill published in the GitHub repository Azure/AKS-Skills (4 stars, last pushed today), licensed MIT. It adds 151 tokens to every session and 1,728 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
azure-kubernetes-automatic-readiness
Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic…
azure-diagnostics
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, troubleshoot functions, troubleshoot AKS, VM RDP, Linux SSH, VM black…
datadog-ninja
Master orchestrator for 57 official Datadog agent skills from DataDog/pup and datadog-labs/agent-skills. Use when working with ANY Datadog observability task: APM and distributed tracing, log search and pipelines, monitors and alerting, live production debugging, audit trail investigations, browser SDK…
azure-ninja
Master orchestrator for 40 Azure agent skills from Microsoft official and community repositories. Use when working with ANY Azure service, architecture, deployment, operations, security, cost optimization, diagnostics, or development task. Routes to the optimal specialized skill based on context. Triggers: Azure…
alibaba-observability-incident-responder
Respond to Alibaba Cloud incidents using CloudMonitor alarms, SLS log analytics, ARMS APM distributed tracing, and alert governance for ECS, RDS, ACK, and network services.
azure-resource-health-incident-triage
Use this skill for Azure Resource Health, Service Health, activity-log alert, and first-pass incident triage when the question is whether Azure platform health is part of the problem.