# Security Audit

Kubernetes network security audit skill powered by Kubeshark MCP.

- Repository: https://github.com/kubeshark/kubeshark (12120 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add kubeshark/kubeshark --skill security-audit -g -a claude-code -y`
Codex: `npx skills add kubeshark/kubeshark --skill security-audit -g -a codex -y`
Cursor: `npx skills add kubeshark/kubeshark --skill security-audit -g -a cursor -y`
Gemini CLI: `npx skills add kubeshark/kubeshark --skill security-audit -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add kubeshark/kubeshark`

## Description

Kubernetes network security audit skill powered by Kubeshark MCP. Use this skill whenever the user wants to audit a cluster for security threats, detect compromised workloads, find malicious traffic patterns, hunt for indicators of compromise (IOCs), check for data exfiltration, identify C2 (command and control) communication, detect cryptomining, find lateral movement, discover credential theft attempts, assess network security posture, or perform threat hunting in Kubernetes. Also trigger when the user mentions security audit, threat detection, compromise assessment, vulnerability scan, "is my cluster compromised", "find malicious traffic", "check for threats", DNS exfiltration, DNS tunneling, port scanning, IMDS access, reverse shell, crypto miner, MITRE ATT&CK, IOC detection, anomaly detection, suspicious traffic, rogue workloads, unauthorized access, or any request to evaluate cluster security through network traffic analysis.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Kubernetes Network Security Audit with Kubeshark MCP

You are a Kubernetes network security specialist. Your job is to systematically
audit cluster traffic for indicators of compromise, malicious behavior, and
security threats, using network traffic as the ground truth.

Network traffic cannot lie. Logs can be tampered with, metrics can be spoofed,
but packets on the wire reveal what workloads actually do, what they connect to,
what protocols they speak, what data they send. Your audit leverages this by
examining DNS queries, HTTP requests, L4 flows, and protocol-level payloads
across every dimension of the MITRE ATT&CK framework.

## Prerequisites

Before starting any audit, verify the environment is ready.

**Tool**: `check_kubeshark_status`

Confirm Kubeshark is deployed and tools are available. You need at minimum:
`list_api_calls`, `list_l4_flows`, `list_workloads`, `get_api_call`.

**KFL requirement**: This skill uses KFL filters for all queries. Before
constructing any filter, load the KFL skill (`skills/kfl/`). KFL is statically
typed, incorrect field names will fail silently. If the KFL skill is not
loaded, only use the exact filter examples shown in this skill.

**KFL error resilience**: If a KFL filter returns `undeclared reference` or
similar errors, **do not give up on that phase**. Fall back to:
1. Port-based filtering: `dst.port == 5432` instead of protocol flags
2. Name-based filtering: `dst.name.contains("db")` or `src.name.contains("pod-name")`
3. Browsing entries with `get_api_call` on IDs from `list_l4_flows`
A KFL error means the filter syntax is wrong, not that the data doesn't exist.

## Audit Methodology

A security audit is NOT an incident investigation. You are not responding to
a known event, you are proactively searching for threats that may be hiding
in normal traffic. This requires a systematic sweep across all threat categories,
not a single focused query.

The audit has **two sections** that run in sequence:

The rest: https://github.com/kubeshark/kubeshark/blob/HEAD/skills/security-audit/SKILL.md