mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-16 20:55:17 +03:00
mukul975
c21af3347e
- Add scripts/agent.py and references/api-reference.md to all remaining skills - Update all 648 LICENSE files: copyright now reads 'Mahipal' - Add implementing-security-monitoring-with-datadog (new skill with full anatomy) - All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md
1.8 KiB
1.8 KiB
API Reference: Scanning Kubernetes Manifests with Kubesec
Kubesec CLI Commands
| Command | Description |
|---|---|
kubesec scan <file> |
Scan a manifest file |
kubesec scan -o json <file> |
JSON output |
kubesec http --port 8080 |
Start local API server |
kubesec version |
Show version info |
Kubesec HTTP API
| Method | Endpoint | Description |
|---|---|---|
| POST | https://v2.kubesec.io/scan |
Public scan API |
| POST | http://localhost:8080/scan |
Local scan API |
Critical Checks (Negative Score)
| Check | Selector | Risk |
|---|---|---|
| Privileged | securityContext.privileged == true |
Full host access |
| HostPID | spec.hostPID == true |
Process namespace escape |
| HostNetwork | spec.hostNetwork == true |
Network namespace escape |
| SYS_ADMIN | capabilities.add contains SYS_ADMIN |
Near-root capability |
Best Practice Checks (Positive Score)
| Check | Points | Description |
|---|---|---|
| ReadOnlyRootFilesystem | +1 | Prevents filesystem writes |
| RunAsNonRoot | +1 | Non-root execution |
| RunAsUser > 10000 | +1 | High UID |
| LimitsCPU | +1 | CPU limits set |
| LimitsMemory | +1 | Memory limits set |
| ServiceAccountName | +3 | Explicit service account |
| AppArmor annotation | +3 | MAC enforcement |
| Seccomp profile | +4 | Syscall filtering |
Python Libraries
| Library | Version | Purpose |
|---|---|---|
subprocess |
stdlib | Execute kubesec CLI |
requests |
>=2.28 | HTTP API fallback |
json |
stdlib | Parse scan results |
References
- Kubesec GitHub: https://github.com/controlplaneio/kubesec
- Kubesec Online: https://kubesec.io/
- CIS Kubernetes Benchmark: https://www.cisecurity.org/benchmark/kubernetes