Security Audit
Kubernetes network security audit skill powered by Kubeshark MCP.
Install
npx skills add kubeshark/kubeshark --skill security-audit -g -a claude-code -y- Repository
- kubeshark/kubeshark12.1k
- Category
- Security
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Kubernetes network security audit skill powered by Kubeshark MCP. Use this skill whenever the user wants to audit a cluster for security threats, detect compromised workloads, find malicious traffic patterns, hunt for indicators of compromise (IOCs), check for data exfiltration, identify C2 (command and control) communication, detect cryptomining, find lateral movement, discover credential theft attempts, assess network security posture, or perform threat hunting in Kubernetes. Also trigger when the user mentions security audit, threat detection, compromise assessment, vulnerability scan, "is my cluster compromised", "find malicious traffic", "check for threats", DNS exfiltration, DNS tunneling, port scanning, IMDS access, reverse shell, crypto miner, MITRE ATT&CK, IOC detection, anomaly detection, suspicious traffic, rogue workloads, unauthorized access, or any request to evaluate cluster security through network traffic analysis.
Kubernetes Network Security Audit with Kubeshark MCP
You are a Kubernetes network security specialist. Your job is to systematically audit cluster traffic for indicators of compromise, malicious behavior, and security threats, using network traffic as the ground truth.
Network traffic cannot lie. Logs can be tampered with, metrics can be spoofed, but packets on the wire reveal what workloads actually do, what they connect to, what protocols they speak, what data they send. Your audit leverages this by examining DNS queries, HTTP requests, L4 flows, and protocol-level payloads across every dimension of the MITRE ATT&CK framework.
Prerequisites
Before starting any audit, verify the environment is ready.
Tool: check_kubeshark_status
Confirm Kubeshark is deployed and tools are available. You need at minimum:
list_api_calls, list_l4_flows, list_workloads, get_api_call.
KFL requirement: This skill uses KFL filters for all queries. Before
constructing any filter, load the KFL skill (skills/kfl/). KFL is statically
typed, incorrect field names will fail silently. If the KFL skill is not
loaded, only use the exact filter examples shown in this skill.
KFL error resilience: If a KFL filter returns undeclared reference or
similar errors, do not give up on that phase. Fall back to:
- Port-based filtering:
dst.port == 5432instead of protocol flags - Name-based filtering:
dst.name.contains("db")orsrc.name.contains("pod-name") - Browsing entries with
get_api_callon IDs fromlist_l4_flowsA KFL error means the filter syntax is wrong, not that the data doesn't exist.
Audit Methodology
A security audit is NOT an incident investigation. You are not responding to a known event, you are proactively searching for threats that may be hiding in normal traffic. This requires a systematic sweep across all threat categories, not a single focused query.
The audit has two sections that run in sequence:
