Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nodnarbnitram/claude-code-extensions/kubernetes-operationsnpx skills add nodnarbnitram/claude-code-extensions --skill kubernetes-operationsgit clone --depth 1 https://github.com/nodnarbnitram/claude-code-extensionsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00067 | $0.02035 |
| Opus 5 | $0.00034 | $0.01018 |
| Sonnet 5 | $0.00013 | $0.00407 |
| Haiku 4.5 | $0.00007 | $0.00203 |
Grade C, and why
kubernetes-operations scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
cat ~/.kube/config Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
kubectl run debug --rm -it --image=busybox -- wget -qO- http://<service>:<port> How it starts
The opening of the file, as written. The whole thing — 314 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kubernetes Operations
Comprehensive kubectl assistance for debugging, resource management, and cluster operations with token-efficient scripts.
BEFORE YOU START
This skill prevents 5 common errors and saves ~70% tokens.
| Metric | Without Skill | With Skill |
|---|---|---|
| Pod Debugging | ~1200 tokens | ~400 tokens |
| Resource Listing | ~800 tokens | ~200 tokens |
| Cluster Health | ~1500 tokens | ~300 tokens |
Known Issues This Skill Prevents
- Running kubectl commands in wrong namespace/context
- Verbose output flooding context with unnecessary data
- Missing critical debugging steps (events, previous logs)
- Exposing secrets in plain text output
- Destructive operations without dry-run verification
Quick Start
Step 1: Verify Context
kubectl config current-context
kubectl config get-contexts
Why this matters: Running commands in the wrong cluster can cause production incidents.
Step 2: Debug a Pod
uv run scripts/debug_pod.py <pod-name> [-n namespace]
Why this matters: The script combines describe, logs, and events into a condensed summary, saving ~800 tokens.
Step 3: Check Cluster Health
uv run scripts/cluster_health.py
Why this matters: Quick overview of node status and unhealthy pods without verbose output.
Critical Rules
Always Do
- Always verify
kubectl config current-contextbefore operations - Always use
-n namespaceto be explicit about target - Always use
--dry-run=client -o yamlbefore applying changes - Always check events when debugging:
kubectl get events --sort-by='.lastTimestamp' - Always use
--previousflag when pod is in CrashLoopBackOff
Never Do
- Never run
kubectl deletewithout--dry-runfirst in production - Never output secrets without filtering: avoid
kubectl get secret -o yaml - Never assume default namespace - always specify
-n - Never ignore resource limits when debugging OOMKilled pods
- Never skip
describewhen logs show no errors
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 314 lines · 67 tokens per session scan C 63b4a9e03a11
kubernetes-operations is a skill published in the GitHub repository nodnarbnitram/claude-code-extensions (16 stars, last pushed 4mo ago), licensed MIT. It adds 67 tokens to every session and 2,035 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cloud-run-basics
Manages Cloud Run services, jobs, and worker pools. Use when you need to deploy applications responding to HTTP requests (services), run event-triggered or scheduled tasks (jobs), or handle always-on pull-based background processing (worker pools).
openshell-cli
Guide agents through using the OpenShell CLI (openshell) for sandbox management, gateway registration, provider configuration and refresh, policy iteration, settings, service exposure, BYOC workflows, and inference routing. Covers basic through advanced multi-step workflows. Trigger keywords - openshell, sandbox…
cloud-k8s
Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
kubernetes-specialist
Use when deploying or managing Kubernetes workloads. Invoke to create deployment manifests, configure pod security policies, set up service accounts, define network isolation rules, debug pod crashes, analyze resource limits, inspect container logs, or right-size workloads. Use for Helm charts, RBAC policies…
langbot-deploy
Deploy and configure a LangBot instance — Docker / Docker Compose, Kubernetes, the config.yaml model, the Box sandbox runtime, the plugin runtime, and the global API key. Use when installing, deploying, upgrading, or configuring LangBot in production or self-hosted environments. Triggers on "deploy langbot", "langbot…
doca-container-deployment
Use this skill when the user is hands-on deploying an in-bundle DOCA service container (Argus, DMS, Firefly, or UROM service) on a BlueField — kubelet standalone watching a static-pod manifests directory, YAML pod-spec drop, kubelet status / ENTRYPOINT logs / per-service liveness, smoke-before-bulk, and the layered…