kube2iam provides different AWS IAM roles to containers running in a Kubernetes cluster by using pod annotations and redirecting their metadata-service requests. It is for multi-tenant Kubernetes environments where containers on the same node need separate permissions for AWS resources. The catalogue add-ons support kube2iam operation and configuration.
Borrowing it
Nothing to install: this file belongs to jtblin/kube2iam. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jtblin/kube2iam/main/.agents/skills/kube2iam_triage/SKILL.mdgit clone --depth 1 https://github.com/jtblin/kube2iamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jtblin/kube2iam/kube2iam_triage)<a href="https://agentmods.dev/skills/jtblin/kube2iam/kube2iam_triage"><img src="https://agentmods.dev/badge/skills/jtblin/kube2iam/kube2iam_triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jtblin/kube2iam/kube2iam_triage"><img src="https://agentmods.dev/badge/skills/jtblin/kube2iam/kube2iam_triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.00351 |
| Opus 5.5 | $0.00012 | $0.00140 |
| Sonnet 5.5 | $0.00006 | $0.00070 |
| Haiku 4.5 | $0.00003 | $0.00035 |
Grade A, and why
kube2iam-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Kube2iam Triage & Design Principles
This skill defines the technical constraints and design patterns specific to the kube2iam project.
When to use this skill
- Use this when triaging issues related to AWS credentials, IAM roles, or STS.
- Use this when designing features that interact with host networking or iptables.
- Use this to address compatibility with local development tools like Minikube.
How to use it
1. Be Mindful of External API Limits
- Principle: Stability of the AWS account takes precedence over minor latency gains.
- Avoid: Do not implement "prefetching" of credentials or high-frequency background refreshes that could lead to account-wide AWS STS/IAM throttling.
- Design: Design solutions that minimize the frequency and volume of AWS API calls.
2. Local Environment & Mocking Support
- Principle: Ensure the tool can run in mock or local environments where cloud services are unavailable.
- Strategy: Implement flags (e.g.,
--disable-metadata-healthcheck) to allow bypassing cloud-specific checks when static credentials are provided.
3. Environmental Troubleshooting
- Clock Sync: For
SignatureDoesNotMatcherrors, always investigate clock drift in the host/VM first. - Race Conditions: Recognize that CNI interfaces may not be ready at startup. Implement graceful retry logic (e.g., 10-15s) in networking setup instead of immediate failure.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 30 lines · 30 tokens per session scan A eba0a52af461
kube2iam-triage is a skill published in the GitHub repository jtblin/kube2iam (2,042 stars, last pushed 5mo ago), licensed BSD-3-Clause. It adds 30 tokens to every session and 351 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ecs-devops
Use when someone is deploying, releasing, or shipping software to Amazon ECS — phrased as "blue/green deployment on ECS", "canary deployment for my ECS service", "set up CI/CD for ECS", "GitHub Actions deploy to Fargate", "my ECS deployment is stuck", "ECS deployment circuit breaker", "ECS task sets", or "migrate off…
ecs-modernize
Assess an existing app (VMware/EC2) by source code analysis for the replatform vs rearchitect decision, and execute the approved migration onto Amazon ECS. Scope: assessment, strategy decision, migration execution. Covers: source code analysis; language/framework detection (Java, .NET, Spring, Struts, WebSphere…
eks-well-architected-review
Deterministic AWS Well-Architected Framework review of an Amazon EKS cluster (Linux nodes only). Unofficial — not the AWS Well-Architected Tool, no official EKS lens exists, and it maps to no compliance framework (CIS, PCI or otherwise). Collects live data via kubectl and aws, scores it across five of the six pillars…
eks-security
EKS security and compliance assessment — 7-layer hardening stack, CIS/HIPAA/PCI/FedRAMP/SOC2/GDPR audit prep, and 30/60/90 roadmap. Covers OS/AMI selection (Bottlerocket, AL2023, RHEL, Ubuntu), identity (EKS Pod Identity vs IRSA, Access Entries vs aws-auth), workload security (Pod Security Admission, Kyverno/OPA…
ecs-build
Use when building Amazon ECS infrastructure with Terraform, generating apply-ready code for ECS clusters, services, and task definitions across three capacity models — Fargate (FARGATESPOT as capacity provider), EC2 Auto Scaling group providers, and ECS Managed Instances. Covers rolling/blue-green/linear/canary…
eks-ingress-migration
Assess a live EKS cluster's NGINX/Ingress estate and plan migration to Gateway API, the AWS Load Balancer Controller (ALB Ingress), or AWS Transform (ATX). Discovers ingress controllers and routes, scores migration difficulty 0–100 with a separate re-architecture gate, and generates per-cluster reports plus…