Container and Kubernetes security assessment skill for Docker, Kubernetes, and container orchestration platforms. This skill should be used when scanning container images for vulnerabilities, auditing Kubernetes cluster security, testing container escape scenarios, reviewing Docker configurations, or performing container runtime security analysis. Triggers on requests to scan Docker images, audit Kubernetes security, test container configurations, or assess container orchestration security.
Thin router for container and Kubernetes security assessments. Load the reference, workflow, or payload file you need — do not read all of them.
"scan this image", "trivy / grype / syft", "audit k8s cluster", "kube-bench", "kubescape", "run CIS benchmark", "check RBAC", "networkpolicy coverage", "falco rule", "container escape", "SBOM diff", "new CVEs since last release".
| Request | Use instead |
|-----------------------------------------------------------------|-------------------|
| Static scan of K8s YAML / Helm / Kustomize before deploy | iac-security |
| Terraform / CloudFormation / Pulumi misconfig | iac-security |
| EKS / GKE / AKS control-plane or managed-service misconfig | cloud-security |
| Cloud IAM misconfiguration (beyond K8s RBAC) | cloud-security |
| Application-code vulns inside the container | sast-orchestration |
| Third-party library CVEs at source-code level | sca-security |
| API endpoints exposed by containerized services | api-security |
Rule of thumb: pre-deployment YAML → iac-security; running cluster or built image → this skill.
Target?
|
|-- Built/registry image ----------> workflows/image_scan.md
| \-- two images to compare? --> workflows/sbom_diff.md (FLAGSHIP)
|
|-- Dockerfile source -------------> examples/vulnerable_dockerfile.md
| + hadolint (references/image_scanning.md)
|
|-- Live K8s cluster --------------> workflows/cluster_audit.md
| |-- RBAC deep-dive ----------> workflows/rbac_analysis.md
| |-- Network policy gap ------> workflows/network_policy_review.md
| \-- CIS benchmark only ------> references/kubernetes_hardening.md
|
|-- Runtime monitoring ------------> references/runtime_security.md
| + examples/falco_custom_rule.yaml
|
\-- Escape testing (authorized) --> references/container_escape.md
+ payloads/container_escape_poc.md
Run concurrently (no shared state, no rate conflicts):
clusterroles, roles, bindings) — parallelSequential only:
workflows/image_scan.md and returns finding records. Parent merges.workflows/cluster_audit.md with its own kubecontext.rbac_analysis, network_policy_review, and runtime log triage in
parallel.| Task | Budget | |---------------------------------------------------------|---------------------| | Running a scanner and capturing output | Minimal | | Applying CIS checks, filling checklists | Minimal | | SBOM canonicalization and package diff | Minimal | | Cross-scanner CVE consensus | Moderate | | RBAC privilege-graph traversal (principal -> cluster-admin) | Extended | | Container escape chain composition | Extended | | SBOM diff CVE exposure scoring + waiver decision | Extended | | Runtime alert triage (chaining Falco events to intent) | Moderate |
Extended thinking pays off where the answer requires composing many small facts into an attack path or risk decision; it does not help when running a scanner and reporting output verbatim.
rbac-tool viz produces graphviz; render as PNG and
embed in report for stakeholder clarity.All findings MUST conform to schemas/finding.json.
Container-security-specific fields: affected.image_digest,
affected.image_tag, affected.cluster_name, affected.namespace,
affected.resource_kind, affected.service_account, cve, cvss,
fixed_version, cis_control, and the sbom_diff block for diff
findings.
| Workflow | Purpose |
|------------------------------------------------------------|---------|
| workflows/image_scan.md | Build-time / registry image vuln scan with consensus merge |
| workflows/sbom_diff.md | Flagship. Compare prior vs current SBOM; flag new CVEs |
| workflows/cluster_audit.md | Live K8s cluster assessment (CIS / NSA / MITRE) |
| workflows/rbac_analysis.md | RBAC privilege mapping and attack-path search |
| workflows/network_policy_review.md | NetworkPolicy coverage + enforcement validation |
| Payload | Purpose |
|---------------------------------------------------------------------------|---------|
| payloads/container_escape_poc.md | Documented escape PoCs (authorized testing only) |
| Reference | Purpose |
|-------------------------------------------------------------------------------|---------|
| references/image_scanning.md | Trivy, Grype, Syft, Clair, Snyk, Hadolint commands |
| references/kubernetes_hardening.md | kube-bench, Kubescape, CIS K8s mapping, PSS |
| references/container_escape.md | Escape vectors, capabilities, runtime CVEs |
| references/runtime_security.md | Falco, Tetragon, eBPF, rule authoring |
| references/bounty_patterns_2024_2026.md | Post-2023 bounty TTPs (CVE-2024-21626 runC, CVE-2025-23266 NVIDIA, SA token theft, RoleBinding privesc) |
| Example | Purpose |
|----------------------------------------------------------------------------------|---------|
| examples/falco_custom_rule.yaml | Ready-to-load Falco rule pack |
| examples/vulnerable_dockerfile.md | Common Dockerfile anti-patterns + fixes |
| Template | Purpose |
|------------------------------------------------------------------------------------------------------------|---------|
| templates/assessment_report_template.md | End-of-engagement deliverable skeleton |
| Tool | Purpose | Install |
|--------------|-------------------------------|-----------------------------------------------|
| Trivy | Image / FS vuln + SBOM + IaC | brew install trivy |
| Grype | Image / SBOM vuln | brew install grype |
| Syft | SBOM generator | brew install syft |
| Hadolint | Dockerfile lint | brew install hadolint |
| Kubescape | K8s security platform | curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh \| /bin/bash |
| kube-bench | CIS K8s benchmark | brew install kube-bench |
| kube-hunter | K8s pentest recon | pip install kube-hunter |
| Falco | Runtime security (eBPF) | Helm chart falcosecurity/falco |
| Tetragon | eBPF detection + enforcement | Helm chart cilium/tetragon |
| Docker Bench | Docker CIS benchmark | git clone https://github.com/docker/docker-bench-security.git |
| Cosign | Sign / attest images + SBOMs | brew install cosign |
| Crane | Registry ops (resolve digest) | brew install crane |
| rbac-tool | RBAC graph visualization | brew install insights-engineering/tap/rbac-tool |
2026-04. Minimum tool versions: Trivy 0.59, Grype 0.87, Syft 1.18, Kubescape 3.0, kube-bench 0.10 (CIS K8s v1.9), Falco 0.38, Tetragon 1.2, Hadolint 2.12, Cosign 2.4.
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer