owasp-kubernetes

Files (12)

• SKILL.md
• K01-Insecure-Workload-Configurations.md · references/
• K02-Overly-Permissive-Authorization-Configurations.md · references/
• K03-Secrets-Management-Failures.md · references/
• K04-Lack-Of-Cluster-Level-Policy-Enforcement.md · references/
• K05-Missing-Network-Segmentation-Controls.md · references/
• K06-Overly-Exposed-Kubernetes-Components.md · references/
• K07-Misconfigured-And-Vulnerable-Cluster-Components.md · references/
• K08-Cluster-To-Cloud-Lateral-Movement.md · references/
• K09-Broken-Authentication-Mechanisms.md · references/
• K10-Inadequate-Logging-And-Monitoring.md · references/
• audit-finding-template.md · template/

SKILL.md (first lines)

# OWASP Kubernetes Top 10 — Skill Entry

This `SKILL.md` is the **entrypoint** for the OWASP Kubernetes Top 10 skill.

The skill encodes the **OWASP Kubernetes Top 10 (2025)** as structured,
machine-readable references that an agent can query to identify, assess, and remediate
Kubernetes security risks.

> [!CAUTION]
> This prompt is an **assistive tool only** and does not replace professional security tooling (SAST, DAST, SCA, penetration testing, compliance scanners) or qualified human review. All AI-generated vulnerability findings **must** be reviewed and validated by qualified security professionals before use. AI outputs may contain inaccuracies, miss critical threats, or produce recommendations that are incomplete or inappropriate for your environment.

## Normative references (Infrastructure Top 10)

- [K01: Insecure Workload Configuration](./references/K01-Insecure-Workload-Configurations.md)
- [K02: Overly Permissive Authorization Configurations](./references/K02-Overly-Permissive-Authorization-Configurations.md)
- [K03: Secrets Management Failures](./references/K03-Secrets-Management-Failures.md)
- [K04: Lack Of Cluster Level Policy Enforcement](./references/K04-Lack-Of-Cluster-Level-Policy-Enforcement.md)
- [K05: Missing Network Segmentation Controls](./references/K05-Missing-Network-Segmentation-Controls.md)
- [K06: Overly Exposed Kubernetes Components](./references/K06-Overly-Exposed-Kubernetes-Components.md)
- [K07: Misconfigured And Vulnerable Cluster Components](./references/K07-Misconfigured-And-Vulnerable-Cluster-Components.md)
- [K08: Cluster To Cloud Lateral Movement](./references/K08-Cluster-To-Cloud-Lateral-Movement.md)
- [K09: Broken Authentication Mechanisms](./references/K09-Broken-Authentication-Mechanisms.md)
- [K10: Inadequate Logging And Monitoring](./references/K10-Inadequate-Logging-And-Monitoring.md)

## Required assessment workflow

1. Establish the assessment scope, evidence sources, and relevant Kubernetes resources.
2. Use the normative references above to identify, assess, and remediate security risks.
3. Record each finding with evidence, affected resources, impact, likelihood, confidence, remediation, and validation steps.
4. Assign each finding one criticality: `Critical`, `High`, `Medium`, `Low`, or `Informational`.
5. Order findings from `Critical` to `Informational`. Within the same level, place the findings with the greatest combined impact and exploitability first.
6. After analysis is complete, generate the final Markdown report using the [audit finding template](./template/audit-finding-template.md).

## Final report requirements

The final report is the required deliverable at the end of every assessment. It must:

* summarize the scope, methodology, overall criticality, and finding count
* present all findings in descending criticality order
* include evidence, risk rationale, remediation, and validation for every finding
* include a remediation summary and assessment limitations
* state `No findings` explicitly when no findings are identified at a criticality level or across the assessment


## Skill layout

* `SKILL.md` — this file (skill entrypoint).
* `references/` — the Kubernetes Top 10 normative documents.
  * `00-vulnerability-index.md` — index of all vulnerability identifiers, categories, and cross-references.
  * `K01` through `K10` — one document per vulnerability aligned with OWASP Kubernetes Top 10 numbering.
* `template/audit-finding-template.md` — base report template with findings ordered by criticality.

From MFSoftwareEngineering/mfse-softwarefactory, CC-BY-SA-4.0.

More from MFSoftwareEngineering/mfse-softwarefactory