Recon Skills is a pack of security-testing skills covering reconnaissance, web applications, APIs, authentication, vulnerability validation, cloud infrastructure, and reporting. Security professionals use it for authorized assessments of systems they own or have written permission to test. The catalogue entries are individual skills from the pack.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add uphiago/recon-skills --skill hunt-k8sgit clone --depth 1 https://github.com/uphiago/recon-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/uphiago/recon-skills/hunt-k8s)<a href="https://agentmods.dev/skills/uphiago/recon-skills/hunt-k8s"><img src="https://agentmods.dev/badge/skills/uphiago/recon-skills/hunt-k8s/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/uphiago/recon-skills/hunt-k8s"><img src="https://agentmods.dev/badge/skills/uphiago/recon-skills/hunt-k8s.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 20 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 22 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 215 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 22 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high YARA Match · line 46 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Server-Side Request Forgery · line 58 Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
- high Supply Chain · line 88 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Supply Chain · line 99 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Supply Chain · line 112 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Tool Misuse · line 112 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Supply Chain · line 164 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Supply Chain · line 168 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Privilege Escalation · line 211 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 212 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 218 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 219 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- medium Data Exfiltration · line 49 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 112 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 145 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 164 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 190 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00159 | $0.06274 |
| Opus 5 | $0.00079 | $0.03137 |
| Sonnet 5 | $0.00032 | $0.01255 |
| Haiku 4.5 | $0.00016 | $0.00627 |
Grade A, and why
hunt-k8s scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 327 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HUNT-K8S — Kubernetes & Docker Security
Crown Jewel Targets
K8s API anonymous cluster-admin = full cluster control. docker.sock + RCE = host root. A single privileged-pod create or a kubelet /run shell pivots one finding to total compromise.
Highest-value findings:
- K8s API anonymous cluster-admin —
system:anonymous/system:unauthenticatedbound to a powerful role (classic misconfig:system:anonymousin aClusterRoleBindingtocluster-admin) → fullkubectl. Mere anonymous200is NOT this (see false-positive section). - Kubelet
10250exec/run —/runreturns command output directly;/execis a SPDY/WebSocket stream (see Phase 3). Either → RCE in any pod → steal that pod's SA token. - API-server-mediated kubelet RCE —
/api/v1/nodes/<node>/proxy/run/...reaches the kubelet through the API server using your (low-priv) token; if RBAC grantsnodes/proxy, you get pod RCE without touching 10250 directly. Primary 2024-2026 vector. - etcd
2379unauth — every Secret (SA tokens, TLS keys, app creds) stored, often plaintext (unlessEncryptionConfigurationis set) → full credential dump. - docker.sock exposure — SSRF/LFI/RCE reaching
/var/run/docker.sock→ create--privilegedcontainer, bind-mount host/→ host root. - Container escape via runc — Leaky Vessels (CVE-2024-21626):
WORKDIR/process.cwdpointing at a leaked/proc/self/fd/<n>host FD → break out of an attacker-controlled image/exec to host root. - SA token abuse — auto-mounted token at
/var/run/secrets/kubernetes.io/serviceaccount/token; check its real grants with SelfSubjectRulesReview before claiming impact. - K8s Dashboard skip-login / token-less API — full cluster management UI reachable unauthenticated.
OOB / Confirmation Gate (Read First)
K8s findings are RCE/credential-disclosure class. House rule: prove state change or data read, never infer from a status code.
- A
200on/api/v1/namespacesdoes not mean cluster-admin. The API server returns200with an RBAC-filtered (often emptyitems: []) list to any principal that can reachlist namespaces— anonymous read on a few resources is common and low-impact. Confirm real privilege with SelfSubjectRulesReview / SelfSubjectAccessReview, then by actually reading a Secret value. - 10255 (read-only) vs 10250 (exec) are constantly conflated. 10255 (HTTP, no auth) is info-disclosure only — it has
/pods,/stats,/metrics, NO exec/run. 10250 (HTTPS) is where/runand/execlive. Do not report "kubelet RCE" off a 10255 hit. - Blind/outbound vectors need OOB. If you exploit SSRF→IMDS→K8s, or a pod's egress, confirm the outbound hop with a Burp Collaborator / interactsh subdomain (e.g.
curl http://<token>.<collab>from inside the pod via/run). A delayed response or an echoed URL is NOT proof. - Impact proof = the artifact. For exec: the literal
id/hostnameoutput. For etcd/Secret: the decoded token bytes (redact in report). For docker.sock escape: the host file content (/etc/hostnameof the node, distinct from the container's). - Use a dedicated test namespace / test pod when you have create rights; never exec into production workloads to "prove" RCE — list the pod and exec a read-only
idin a pod you spun up if policy allows, or limit to a single non-destructiveidand stop.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 327 lines · 159 tokens per session scan F b54e24790d92
hunt-k8s is a skill published in the GitHub repository uphiago/recon-skills (1,254 stars, last pushed 10d ago), licensed MIT. It adds 159 tokens to every session and 6,274 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
kubernetes-rbac-exploitation
Exploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.
auditing-kubernetes-cluster-rbac
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.
kubernetes-rbac-exploitation
Exploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.
detecting-privilege-escalation-in-kubernetes-pods
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
implementing-opa-gatekeeper-for-policy-enforcement
Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, Rego rules, and the Gatekeeper policy library.
detecting-container-drift-at-runtime
Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.