Production hardening: security fixes, code quality, 724 skills complete

- Fix 25 shell=True subprocess calls with list-based commands
- Fix 49 verify=False in defensive skills (env-var override)
- Add timeout to 231 HTTP/subprocess/socket calls
- Fix 6 SQL injection patterns with whitelist validation
- Replace 8 __import__() with standard imports
- Remove 701 unused imports across 442 files
- Add authorized-testing disclaimers to all offensive skills
- Complete 11 incomplete skill directories
- Expand 10 stub SKILL.md files with full content
- Fix 2 YAML parse errors in frontmatter
- Fix 5 pre-existing syntax errors
- Convert 22 hardcoded paths/ports to environment variables
- Back up 21 redundant skill pairs to .bak
- Fix 2 global declaration errors
- 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE)
- 0 compile errors across all 724 agent.py files

skills/implementing-rbac-for-kubernetes-cluster.bak/references/workflows.md

@@ -0,0 +1,36 @@
+# Kubernetes RBAC Workflows
+
+## Workflow 1: New Team Onboarding
+1. Create dedicated namespace for the team
+2. Create ResourceQuota and LimitRange for the namespace
+3. Create NetworkPolicy to isolate namespace traffic
+4. Design Roles based on team member personas (admin, developer, viewer)
+5. Create RoleBindings mapped to OIDC groups
+6. Create dedicated service accounts for CI/CD
+7. Test access with `kubectl auth can-i` for each persona
+8. Document namespace ownership and contact
+
+## Workflow 2: RBAC Audit
+1. List all ClusterRoleBindings: `kubectl get clusterrolebindings -o wide`
+2. Identify bindings to cluster-admin role
+3. Review each cluster-admin binding for necessity
+4. Check for wildcard permissions in custom roles
+5. Verify service accounts have minimum permissions
+6. Test pod escape scenarios (exec, privileged containers)
+7. Generate compliance report with findings
+
+## Workflow 3: Privilege Escalation Prevention
+1. Restrict who can create/modify Roles and RoleBindings
+2. Prevent escalate verb usage (only cluster-admin should have it)
+3. Block bind verb for non-admin users
+4. Prevent impersonate verb usage
+5. Use admission controllers (OPA Gatekeeper) for policy enforcement
+6. Monitor audit logs for RBAC modification attempts
+
+## Workflow 4: Service Account Hardening
+1. List all service accounts: `kubectl get sa --all-namespaces`
+2. Identify service accounts with ClusterRole bindings
+3. Remove unnecessary ClusterRoleBindings
+4. Set automountServiceAccountToken: false in namespace default SA
+5. Create per-application service accounts with minimum roles
+6. Use projected service account tokens with short expiry