Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add magnus919/agent-skills --skill kubernetesgit clone --depth 1 https://github.com/magnus919/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/magnus919/agent-skills/kubernetes)<a href="https://agentmods.dev/skills/magnus919/agent-skills/kubernetes"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/kubernetes/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/magnus919/agent-skills/kubernetes"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/kubernetes.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 24 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 90 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00141 | $0.01371 |
| Opus 5 | $0.00071 | $0.00685 |
| Sonnet 5 | $0.00028 | $0.00274 |
| Haiku 4.5 | $0.00014 | $0.00137 |
Grade A, and why
kubernetes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kubernetes
Use this skill as a decision and routing layer. Do not treat it as a static kubectl cheat sheet.
Operating contract
- Identify the target: distribution, provider, cluster version, client version, context, namespace, access mode, and whether the cluster is production.
- Discover before assuming: query served API resources, API versions, CRDs, system workloads, nodes, and distribution markers.
- Separate portable Kubernetes behavior from distribution/provider overlays. Load the matching reference before using lifecycle, networking, identity, storage, or upgrade instructions.
- For mutations, preview first (
k8s-cli ... --dry-runorkubectl diff/ server dry-run), state scope, require explicit confirmation for destructive actions, then verify conditions, events, rollout, and the external boundary. - Prefer stable APIs and server-side validation. Treat beta/alpha APIs, feature gates, provider defaults, and version numbers as time-sensitive.
- Keep evidence bounded and structured. Never dump kubeconfigs, Secret values, tokens, or unbounded logs into chat.
Choose the operating path
| Situation | First move | Do not do |
|---|---|---|
| Live cluster operation | Run doctor, context, and discover; record context, namespace, distribution, and versions |
Do not infer cluster state from configuration or a prior command |
| No cluster access | Produce a bounded plan and name the missing prerequisite | Do not claim a diagnosis, success, or invented command output |
| Any mutation | Render, diff/server-dry-run, state scope, obtain the required confirmation, then mutate and verify the relevant boundary | Do not treat command exit 0 as operational success |
| Provider or distribution present | Load the matching overlay before applying portable guidance | Do not apply upstream instructions unchanged |
First-response discovery
scripts/k8s-cli --json doctor
scripts/k8s-cli --json context
scripts/k8s-cli --json discover
If the wrapper is unavailable, use the equivalent native commands from references/cli-reference.md. If kubectl is absent, stop and report the prerequisite rather than inventing cluster state.
What ships with it
31 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 8.5 KB
- README.md 2.5 KB
- references/api-and-versioning.md 2.6 KB
- references/backup-restore.md 1.8 KB
- references/cli-reference.md 1.6 KB
- references/debugging.md 1.1 KB
- references/distributions.md 3.7 KB
- references/networking.md 1.6 KB
- references/nodes-and-reliability.md 1.5 KB
- references/observability.md 2.3 KB
- references/operations.md 2.1 KB
- references/policy.md 1.3 KB
- references/safety-gates.md 1.1 KB
- references/scheduling-scaling-storage.md 2.7 KB
- references/security-and-policy.md 4.1 KB
- references/source-index.md 2.9 KB
- references/troubleshooting.md 2.0 KB
- references/version-skew.md 1.1 KB
- references/workloads-and-rollouts.md 2.0 KB
- scripts/gather-cluster-state.sh 858 B runs code
- scripts/k8s-cli 10 KB
- scripts/refresh-version-matrix.sh 666 B runs code
- scripts/test-k8s-cli.sh 1.0 KB runs code
- scripts/verify-cluster-health.sh 632 B runs code
- templates/cluster-inventory.json 570 B
- templates/deployment.yaml 776 B
- templates/diagnostic-report.md 632 B
- templates/hpa.yaml 369 B
- templates/networkpolicy-default-deny.yaml 179 B
- templates/pdb.yaml 188 B
- templates/upgrade-runbook.md 999 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 95 lines · 141 tokens per session scan A ed56ec157464
kubernetes is a skill published in the GitHub repository magnus919/agent-skills (76 stars, last pushed yesterday), licensed MIT. It adds 141 tokens to every session and 1,371 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
langbot-deploy
Deploy and configure a LangBot instance — Docker / Docker Compose, Kubernetes, the config.yaml model, the Box sandbox runtime, the plugin runtime, and the global API key. Use when installing, deploying, upgrading, or configuring LangBot in production or self-hosted environments. Triggers on "deploy langbot", "langbot…
compute-env-setup
Set up a compute environment on a remote provider so Claude Science jobs can run there. Covers direct SSH/conda hosts, Slurm clusters, container-via-bridge runners, and managed-API providers (Modal, GCP, RunPod). Use when standing up a new provider, porting an env to a different backend, adding a tool that needs its…
atmos-helmfile
Helmfile orchestration: sync/apply/destroy/diff, Kubernetes deployments, varfile generation, EKS integration, source management.
atmos-devcontainer
Devcontainer orchestration: start/stop/attach/shell/exec/rebuild, instance management, config handling, VS Code integration.
atmos-container
Atmos container components: components.container, Docker Compose migration, build/run/push/pull/up/down/list/ps/logs/exec, stack-scoped persistent containers, container workflow steps, compositions, and hooks.
atmos-emulator
Atmos emulator components: local AWS/GCP/Azure/Kubernetes/Vault/OpenBao/registry emulators, components.emulator, !emulator, identities, persistence, health checks, and emulator commands.