cloud-k8s
starsforks
How to install cloud-k8s?
zhaoxuya520/reverse-skill/cloud-k8s
$npx -y skills add zhaoxuya520/reverse-skill --skill cloud-k8sUse for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
SKILL.md
| 1 | # Cloud / Container / Kubernetes Security |
| 2 | |
| 3 | ## ACTION REQUIRED（读完后立刻执行） |
| 4 | |
| 5 | 1. `NOW`: 读取 `../field-journal/precedent-pentest.md` — **云/K8s 测试必须书面授权** |
| 6 | 2. `NOW`: case-init + scope；明确账号边界、禁止破坏性操作 |
| 7 | 3. `NOW`: 确认是云元数据/容器/K8s/IAM，而非普通 Web 扫（后者 `pentest-tools/`） |
| 8 | 4. `NEXT`: tool-index；kubectl/aws/gcloud 等多为手动安装 |
| 9 | 5. `ACT`: 从「身份与暴露面」开始，禁止默认全网扫描 |
| 10 | |
| 11 | ## 适用场景 |
| 12 | |
| 13 | - 云元数据 SSRF（169.254.169.254 / IMDS） |
| 14 | - IAM 过度权限、公开存储桶、错误安全组 |
| 15 | - Docker/containerd 逃逸路径评估 |
| 16 | - Kubernetes RBAC、Secrets、Admission、供应链镜像 |
| 17 | - 容器镜像漏洞（可联动 `supply-chain-security/`） |
| 18 | |
| 19 | ## 工作流 |
| 20 | |
| 21 | ### Phase 1 — 身份与边界 |
| 22 | |
| 23 | ```text |
| 24 | □ 当前身份：云 AK/SK、K8s SA、节点 SSH？ |
| 25 | □ 范围：单账号 / 单 cluster / 单 namespace |
| 26 | □ 网络档：authorized_target_only |
| 27 | ``` |
| 28 | |
| 29 | ### Phase 2 — 云控制面 |
| 30 | |
| 31 | ```bash |
| 32 | # 示例（按厂商替换；MUST 在授权账号内） |
| 33 | aws sts get-caller-identity |
| 34 | aws s3 ls |
| 35 | # Azure / GCP 对应 identity 命令 |
| 36 | ``` |
| 37 | |
| 38 | ```text |
| 39 | □ 公开桶 / 错误 ACL |
| 40 | □ 元数据：IMDSv1 vs v2；SSRF 链 |
| 41 | □ 角色可扮演（PassRole）与横向 |
| 42 | ``` |
| 43 | |
| 44 | ### Phase 3 — 容器 |
| 45 | |
| 46 | ```text |
| 47 | □ 是否 privileged / hostPath / hostNetwork |
| 48 | □ capabilities（SYS_ADMIN 等） |
| 49 | □ 可写宿主机路径 → 逃逸候选 |
| 50 | □ 镜像历史与已知 CVE → Trivy |
| 51 | ``` |
| 52 | |
| 53 | ### Phase 4 — Kubernetes |
| 54 | |
| 55 | ```bash |
| 56 | kubectl auth can-i --list |
| 57 | kubectl get pods,secrets,svc -A |
| 58 | kubectl get clusterrolebindings |
| 59 | ``` |
| 60 | |
| 61 | ```text |
| 62 | □ SA token 挂载与权限 |
| 63 | □ 危险 admission webhook 缺失 |
| 64 | □ etcd / dashboard 暴露 |
| 65 | □ 网络策略是否默认放行 |
| 66 | ``` |
| 67 | |
| 68 | ## 工具链 |
| 69 | |
| 70 | | 工具 | 用途 | 自举 | |
| 71 | |------|------|------| |
| 72 | | kubectl | 集群交互 | 手动 | |
| 73 | | trivy | 镜像/IaC | bootstrap `trivy` 若可用 | |
| 74 | | kube-bench / kubeaudit | CIS/配置 | 手动 | |
| 75 | | pacu / scoutsuite | 云审计（授权） | 手动 | |
| 76 | | nuclei | 已知云漏洞模板 | bootstrap nmap/nuclei 生态 | |
| 77 | |
| 78 | ## 参考 |
| 79 | |
| 80 | - `references/k8s-cloud-checklist.md` |
| 81 | - CTF 对照：`../../CTF-Sandbox-Orchestrator/competition-agent-cloud/` |
| 82 | - `../supply-chain-security/` `../pentest-tools/` |
| 83 | |
| 84 | ## 路由上下文 |
| 85 | |
| 86 | **上游**: MASTER R23 |
| 87 | **下游**: 拿到节点 shell → `attack-chain` / `windows-ad`；镜像漏洞 → supply-chain |
| 88 | **MUST NOT**: 未授权扫公有云其他租户 |
| 89 | |
| 90 | ## 任务完成自检 |
| 91 | |
| 92 | - [ ] 是否限定在授权账号/cluster？ |
| 93 | - [ ] 发现是否含复现与影响？ |
| 94 | - [ ] 是否避免破坏性操作？ |
| 95 | - [ ] 报告 / journal？ |
People who liked this also viewed
6 picksType
- microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026
- azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026
- azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026
- azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026
- azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026
- azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
