Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nitinjain999/platform-skills --skill kubescape-operatorgit clone --depth 1 https://github.com/nitinjain999/platform-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nitinjain999/platform-skills/kubescape-operator)<a href="https://agentmods.dev/skills/nitinjain999/platform-skills/kubescape-operator"><img src="https://agentmods.dev/badge/skills/nitinjain999/platform-skills/kubescape-operator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nitinjain999/platform-skills/kubescape-operator"><img src="https://agentmods.dev/badge/skills/nitinjain999/platform-skills/kubescape-operator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00203 | $0.03580 |
| Opus 5.5 | $0.00081 | $0.01432 |
| Sonnet 5.5 | $0.00041 | $0.00716 |
| Haiku 4.5 | $0.00020 | $0.00358 |
Grade A, and why
kubescape-operator scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| No metrics | port-forward the exporter, `curl /metrics` | ServiceMonitor selection, or scans failing | How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Run Kubescape inside the cluster: posture that updates itself, CVEs ranked by whether they load, alerts on behaviour a container never showed, and NetworkPolicies drafted from real traffic.
Read references/kubescape-operator.md before responding. It holds the preflight, the capability matrix and install profiles, the scanner image override, result commands, runtime and NetworkPolicy details, exceptions, metrics and troubleshooting. The working files are in examples/kubescape-operator.
The GitOps engine for this organisation is ${user_config.gitops_engine}. If that reads as a literal placeholder or is empty, it is not configured: detect Flux (kubectl get crd helmreleases.helm.toolkit.fluxcd.io) or Argo CD (kubectl get crd applications.argoproj.io), or ask.
Ownership boundary (enforced at the menu)
| Question | Authoritative command |
|---|---|
| "Scan continuously, keep results in the cluster" | this command |
| "Which CVEs are in code that actually runs?" | this command (vulns) |
| "Alert on unexpected container behaviour" | this command (runtime), or /platform-skills:runtime-security where Falco runs |
| "Draft NetworkPolicies from traffic" | this command (netpol) |
| "Score the cluster now / CIS audit / PR gate" | /platform-skills:kubescape |
| "CVE reports with Trivy Operator" | /platform-skills:trivy k8s |
| "Dashboards and alert routing" | /platform-skills:observability |
Mode dispatch
Parse the first word of $ARGUMENTS as the mode. When $ARGUMENTS is empty, or is a question in plain words, run the interactive wizard.
| Mode | What it does |
|---|---|
install |
Preflight, pick a profile, write the Flux (or Argo CD) manifests, install, verify, upgrade or roll back |
vulns |
Read and rank vulnerability results; on-demand scan; private registries |
runtime |
Enable detection, check learning progress, bind rules, route alerts, test an alert |
netpol |
Turn a generated policy into a reviewed NetworkPolicy in Git |
exceptions |
Accept a risk in the cluster: SecurityException with reason, author, expiry |
metrics |
Exporter, ServiceMonitor, alert rules |
debug |
Diagnose an operator that installs but misbehaves |
| (empty) | Interactive wizard |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 214 lines · 203 tokens per session scan A 564501024e3a
kubescape-operator is a skill published in the GitHub repository nitinjain999/platform-skills (70 stars, last pushed today), licensed Apache-2.0. It adds 203 tokens to every session and 3,580 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-18.
Other skills, from other repositories
add-helm-chart
Scaffold a new Helm chart with standard templates and values. Use when deploying a new microservice or component to Kubernetes and it needs its own chart.
kubernetes-orchestration
Comprehensive guide to Kubernetes container orchestration, covering workloads, networking, storage, security, and production operations.
helm
Helm chart authoring, templating, and release management for Kubernetes: charts, values, templating functions, repositories, dependencies, and lifecycle operations.
tcp-tuner
Use when the user wants to tune, benchmark, or optimise TCP performance on Kubernetes worker nodes — walks through baseline measurement, the SLO convergence loop, the sysctl tuning playbook, fault-injection testing, and saving a runbook. Also activates for phrases like "improve throughput", "reduce retransmits"…
detecting-privilege-escalation-in-kubernetes-pods
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
nvca-values-customization
Customize NVCA Operator Helm chart values in the native monorepo. Use when modifying vendored defaults, changing stack-derived install values, adding deployment-time overrides, or updating scripts under deploy/helm/nvca-operator.