Skip to content
Get packs

Kubernetes RBAC Privilege Escalation Audit

Audits Kubernetes RBAC to find subjects that could escalate privileges toward cluster-admin.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

Once installed, the agent can review a Kubernetes cluster's access rules and find accounts that have dangerous permissions, such as the ability to create privileged pods, read secrets, or bind themselves to admin roles. It runs kubectl and related tools to list effective permissions per service account, then produces a prioritized findings report with least-privilege fixes. It is an offensive-style audit: it can also demonstrate one escalation path in a lab.

Great for

  • Platform or security engineers running an authorized Kubernetes security review or penetration test
  • Teams checking RBAC drift before a production release or after a Helm or platform migration
  • Responders trying to learn what a compromised pod's service-account token can reach

Skip it if

  • Designing or applying hardened RBAC rules, which the skill itself says belongs to a different skill (implementing-rbac-hardening-for-kubernetes) (wrong tool for that job)
  • Clusters you do not own or lack written authorization to assess, because probing live RBAC can affect the cluster's access posture and may be unlawful
  • Non-expert users without kubectl access to a cluster, since the skill cannot produce useful results without credentials

Try asking

  • “Audit which service accounts in my dev cluster can create pods or read secrets across all namespaces”
  • “Check whether the builder service account can escalate roles or bind to cluster-admin”
  • “List every ClusterRoleBinding that grants cluster-admin and explain the risk”
  • “Validate least privilege after we changed our RBAC policies this week”
Step-by-step guide: how to use Kubernetes RBAC Privilege Escalation AuditInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    auditing-kubernetes-rbac-privilege-escalation.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip auditing-kubernetes-rbac-privilege-escalation.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip auditing-kubernetes-rbac-privilege-escalation.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run only against clusters you own or are explicitly authorized to test, and keep a written scope.
  • Review scripts/agent.py and the download step for rbac-police before running, since the skill downloads and executes third-party binaries and runs kubectl commands against live clusters.
  • Start with read-only checks such as kubectl auth can-i and the RBAC inventory before attempting any demonstrated escalation path.

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.