Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nitinjain999/platform-skills --skill kubescapegit clone --depth 1 https://github.com/nitinjain999/platform-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nitinjain999/platform-skills/kubescape)<a href="https://agentmods.dev/skills/nitinjain999/platform-skills/kubescape"><img src="https://agentmods.dev/badge/skills/nitinjain999/platform-skills/kubescape/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nitinjain999/platform-skills/kubescape"><img src="https://agentmods.dev/badge/skills/nitinjain999/platform-skills/kubescape.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00217 | $0.03634 |
| Opus 5.5 | $0.00087 | $0.01454 |
| Sonnet 5.5 | $0.00043 | $0.00727 |
| Haiku 4.5 | $0.00022 | $0.00363 |
Grade A, and why
kubescape scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 223 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Find out how a Kubernetes change or cluster measures up against a security framework, in plain language, and stop new problems at the pull request.
Read references/kubescape.md before responding. It holds the verified install, the framework table, gate exit codes, the baseline recipe, how the two exception actions really behave, fix limits, the VAP rollout, and troubleshooting. The working files are in examples/kubescape.
The primary cloud for this organisation is ${user_config.primary_cloud}. If that reads as a literal placeholder or is empty, it is not configured: detect the provider from the cluster, or ask.
Ownership boundary (enforced at the menu)
| Question | Authoritative command |
|---|---|
| "Does this manifest / chart / cluster meet NSA, MITRE, CIS or SOC2?" | this command |
| "Block insecure Kubernetes changes in PRs" | this command (ci) |
| "Scan continuously, see which CVEs actually load, alert on runtime behaviour, generate NetworkPolicies" | /platform-skills:kubescape-operator |
| "Is this image safe to ship?" (CI gate) | /platform-skills:trivy |
| "Will this pass admission?" (cluster runs Kyverno) | /platform-skills:kyverno |
| "Is my Terraform misconfigured?" | /platform-skills:checkov |
| "Is this production-ready overall?" | /platform-skills:preflight |
Mode dispatch
Parse the first word of $ARGUMENTS as the mode. When $ARGUMENTS is empty, or is a question in plain words, run the interactive wizard.
| Mode | What it does |
|---|---|
scan |
Score manifests, a Helm chart, a Kustomize overlay or a git URL against a framework |
cluster |
Score the live cluster in the current kube context (or several contexts) |
ci |
Add a GitHub Actions gate that fails a PR only on findings it introduces |
exceptions |
Accept a risk properly: an exceptions entry that suppresses, with a review date |
fix |
Preview and apply Kubescape's automatic fixes, then hand-fix the rest |
vap |
Enforce a control at admission with Kubescape's CEL policy library (Warn → Deny) |
image |
One-off image CVE check (CI image gates live in /platform-skills:trivy) |
| (empty) | Interactive wizard |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 223 lines · 217 tokens per session scan A 18c567c2d94d
kubescape is a skill published in the GitHub repository nitinjain999/platform-skills (70 stars, last pushed today), licensed Apache-2.0. It adds 217 tokens to every session and 3,634 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-18.
Other skills, from other repositories
aw-author
Author, validate, and improve GitHub Agentic Workflow (gh-aw) markdown files. Use when the user wants to create a new workflow, validate an existing workflow, improve a workflow, or debug workflow issues. Triggers on: "aw-author", "agentic workflow", "gh-aw workflow", "workflow markdown", "workflow frontmatter"…
devops
Use when setting up CI/CD pipelines, deploying applications, managing cloud infrastructure (AWS, GCP, Azure), implementing monitoring, containerizing services, or automating deployments with infrastructure as code.
complete-infra
Complete infrastructure task — lint, validate, review, and submit PR. Use when an infrastructure-only branch is ready for submission — runs Terraform/Helm validation and creates the PR, skipping application/frontend checks.
infra-plan
Plan infrastructure changes — Terraform modules, Helm charts, CI/CD pipelines. Use when the user wants to add or modify cloud infrastructure, Kubernetes resources, or deployment pipelines.
infrastructure-planning
Plan and document the required software, infrastructure, and logistics for a Paperclip company — domains, GitHub, Docker Hub, Kubernetes, Slack, Google Workspace, Stripe, shipping providers, and CI/CD pipelines. Use when setting up infrastructure for a new company or auditing what an existing company needs.
operating-github-ci-fixer
Use when the user asks OpenSRE to fix failing GitHub CI, GitHub Actions checks, failing pull request checks, a broken PR branch, or CI on a named branch such as main.