kube2iam provides different AWS IAM roles to containers running in a Kubernetes cluster by using pod annotations and redirecting their metadata-service requests. It is for multi-tenant Kubernetes environments where containers on the same node need separate permissions for AWS resources. The catalogue add-ons support kube2iam operation and configuration.
Borrowing it
Nothing to install: this file belongs to jtblin/kube2iam. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jtblin/kube2iam/main/.agents/skills/kube2iam_triage/SKILL.mdgit clone --depth 1 https://github.com/jtblin/kube2iamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jtblin/kube2iam/kube2iam_triage)<a href="https://agentmods.dev/skills/jtblin/kube2iam/kube2iam_triage"><img src="https://agentmods.dev/badge/skills/jtblin/kube2iam/kube2iam_triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jtblin/kube2iam/kube2iam_triage"><img src="https://agentmods.dev/badge/skills/jtblin/kube2iam/kube2iam_triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.00351 |
| Opus 5 | $0.00015 | $0.00176 |
| Sonnet 5 | $0.00006 | $0.00070 |
| Haiku 4.5 | $0.00003 | $0.00035 |
Grade A, and why
kube2iam-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Kube2iam Triage & Design Principles
This skill defines the technical constraints and design patterns specific to the kube2iam project.
When to use this skill
- Use this when triaging issues related to AWS credentials, IAM roles, or STS.
- Use this when designing features that interact with host networking or iptables.
- Use this to address compatibility with local development tools like Minikube.
How to use it
1. Be Mindful of External API Limits
- Principle: Stability of the AWS account takes precedence over minor latency gains.
- Avoid: Do not implement "prefetching" of credentials or high-frequency background refreshes that could lead to account-wide AWS STS/IAM throttling.
- Design: Design solutions that minimize the frequency and volume of AWS API calls.
2. Local Environment & Mocking Support
- Principle: Ensure the tool can run in mock or local environments where cloud services are unavailable.
- Strategy: Implement flags (e.g.,
--disable-metadata-healthcheck) to allow bypassing cloud-specific checks when static credentials are provided.
3. Environmental Troubleshooting
- Clock Sync: For
SignatureDoesNotMatcherrors, always investigate clock drift in the host/VM first. - Race Conditions: Recognize that CNI interfaces may not be ready at startup. Implement graceful retry logic (e.g., 10-15s) in networking setup instead of immediate failure.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 30 lines · 30 tokens per session scan A eba0a52af461
kube2iam-triage is a skill published in the GitHub repository jtblin/kube2iam (2,042 stars, last pushed 4mo ago), licensed BSD-3-Clause. It adds 30 tokens to every session and 351 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Cloud Security & Container Hardening
AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment.
eks-security
EKS security and compliance assessment — 7-layer hardening stack, CIS/HIPAA/PCI/FedRAMP/SOC2/GDPR audit prep, and 30/60/90 roadmap. Covers OS/AMI selection (Bottlerocket, AL2023, RHEL, Ubuntu), identity (EKS Pod Identity vs IRSA, Access Entries vs aws-auth), workload security (Pod Security Admission, Kyverno/OPA…
ecs-build
Use when building Amazon ECS infrastructure with Terraform, generating apply-ready code for ECS clusters, services, and task definitions across three capacity models — Fargate (FARGATESPOT as capacity provider), EC2 Auto Scaling group providers, and ECS Managed Instances. Covers rolling/blue-green/linear/canary…
ecs-devops
Use when someone is deploying, releasing, or shipping software to Amazon ECS — phrased as "blue/green deployment on ECS", "canary deployment for my ECS service", "set up CI/CD for ECS", "GitHub Actions deploy to Fargate", "my ECS deployment is stuck", "ECS deployment circuit breaker", "ECS task sets", or "migrate off…
ecs-modernize
Assess an existing app (VMware/EC2) by source code analysis for the replatform vs rearchitect decision, and execute the approved migration onto Amazon ECS. Scope: assessment, strategy decision, migration execution. Covers: source code analysis; language/framework detection (Java, .NET, Spring, Struts, WebSphere…
skill-creator
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.