New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Kubeshark KFL2 Filter Reference

by kubeshark in kubeshark/kubeshark

Syntax reference for KFL2, the CEL-based display filter language used to search Kubernetes network traffic captured by Kubeshark, loaded before any filter is written.

Apache-2.0Auto-check passedDevOps & Cloud

Install Kubeshark KFL2 Filter Reference

skills CLI
$ npx skills add kubeshark/kubeshark --skill kfl -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install kubeshark/kubeshark kfl --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/kubeshark/kubeshark.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/kfl .claude/skills/kfl && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
kfl
GitHub stars
12k
Token cost
~3.6k tokens
SKILL.md length
632 words
Files
2 (incl. references)
Skills in repo
4
Repo updated
First seen
Licence
Apache-2.0

At a glance

Syntax reference for KFL2, the CEL-based display filter language used to search Kubernetes network traffic captured by Kubeshark, loaded before any filter is written.

  • Works in 5 steps: Protocol flags first — http && ... is… → startsWith/endsWith over contains —… → Specific ports before string ops —… → …
  • Writing a filter to show only failing HTTP responses in a namespace
  • SKILL.md covers Core Syntax, Protocol Detection, Kubernetes Context and HTTP Filtering, plus 3 more sections
  • Calls mysql

What it does

KFL2 is built on Google's Common Expression Language and works as a display filter: it changes what you see, not what Kubeshark captures. The skill makes the agent write filters from the reference instead of guessing, since the language is statically typed and a wrong field name or syntax error fails silently or raises an error. An empty filter matches everything.

The core section lists comparison, logical, arithmetic, membership and ternary operators, string functions such as contains, startsWith and endsWith, collection functions like size and key lookup, and time functions for timestamps, durations and now. It also shows negation patterns, for example excluding health-check paths from HTTP results. A table of protocol flags (http, dns, tls, tcp, udp, grpc, redis, kafka, mongodb, postgresql and more) is meant to be the first term of a filter. The full field reference sits in `references/kfl2-reference.md`; the excerpt is cut off after the protocol table.

When your agent uses it

  • Writing a filter to show only failing HTTP responses in a namespace
  • Narrowing captured traffic by pod, service, label or annotation
  • Searching for DNS lookups, Redis commands or Kafka topics in cluster traffic
  • Building time-bounded traffic queries during an incident

Example prompts

  • “Write a KFL filter for HTTP requests returning 500 from the payments namespace.”
  • “Show me only DNS lookups that failed, excluding anything from kube-system.”
  • “Build a filter for gRPC calls slower than five seconds in the last ten minutes.”
  • “How do I filter out /health requests but keep every other HTTP call?”

Requirements

  • A Kubeshark deployment capturing cluster traffic

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Protocol flags first — http && ... is faster than ... && http
  2. startsWith/endsWith over contains — prefix/suffix checks are faster
  3. Specific ports before string ops — dst.port == 80 is cheaper than url.contains(...)
  4. Use map_get for labels — avoids errors on missing keys
  5. Keep filters simple — CEL short-circuits on &&, so put cheap checks first

What it can do on your machine

Read from SKILL.md and the folder at commit 2d8a22d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • mysql

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Kubeshark KFL2 Filter Reference loads about 3.6k tokens when it runs, and up to ~9k if it reads all its reference files. Until then it costs about 234 tokens; SKILL.md has 632 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~234
When it runs · the whole SKILL.md, loaded when a task matches
~3.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from kubeshark/kubeshark at commit 2d8a22d, republished under its Apache-2.0 licence (© kubeshark). 632 words, ~3,588 tokens.

Download SKILL.mdSave it as .claude/skills/kfl/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
kfl
description
KFL2 (Kubeshark Filter Language) reference. This skill MUST be loaded before writing, constructing, or suggesting any KFL filter expression. KFL is statically typed — incorrect field names or syntax will fail silently or error. Do not guess at KFL syntax without this skill loaded. Trigger on any mention of KFL, CEL filters, traffic filtering, display filters, query syntax, filter expressions, write a filter, construct a query, build a KFL, create a filter expression, "how do I filter", "show me only", "find traffic where", protocol-specific queries (HTTP status codes, DNS lookups, Redis commands, Kafka topics), Kubernetes-aware filtering (by namespace, pod, service, label, annotation), L4 connection/flow filters, time-based queries, or any request to slice/search/narrow network traffic in Kubeshark. Also trigger when other skills need to construct filters — KFL is the query language for all Kubeshark traffic analysis.
user-invocable
false
last-updated
2026-05-08

KFL2 — Kubeshark Filter Language

You are a KFL2 expert. KFL2 is built on Google's CEL (Common Expression Language) and is the query language for all Kubeshark traffic analysis. It operates as a display filter — it doesn't affect what's captured, only what you see.

Think of KFL the way you think of SQL for databases or Google search syntax for the web. Kubeshark captures and indexes all cluster traffic; KFL is how you search it.

For the complete variable and field reference, see references/kfl2-reference.md.

Core Syntax

KFL expressions are boolean CEL expressions. An empty filter matches everything.

Operators
CategoryOperators
Comparison==, !=, <, <=, >, >=
Logical&&, ||, !
Arithmetic+, -, *, /, %
Membershipin
Ternarycondition ? true_val : false_val
String Functions
str.contains(substring)      // Substring search
str.startsWith(prefix)       // Prefix match
str.endsWith(suffix)         // Suffix match
str.matches(regex)           // Regex match
size(str)                    // String length
Collection Functions
size(collection)             // List/map/string length
key in map                   // Key existence
map[key]                     // Value access
map_get(map, key, default)   // Safe access with default
value in list                // List membership
Time Functions
timestamp("2026-03-14T22:00:00Z")   // Parse ISO timestamp
duration("5m")                        // Parse duration
now()                                 // Current time (snapshot at filter creation)
Negation
!http                                // Everything that is NOT HTTP
http && status_code != 200           // HTTP responses that aren't 200
http && !path.contains("/health")    // Exclude health checks
!(src.pod.namespace == "kube-system")  // Exclude system namespace

Protocol Detection

Boolean flags that indicate which protocol was detected. Use these as the first filter term — they're fast and narrow the search space immediately.

FlagProtocolFlagProtocol
httpHTTP/1.1, HTTP/2redisRedis
dnsDNSkafkaKafka
tlseBPF TLS interceptionamqpAMQP
tcpTCPldapLDAP
udpUDPwsWebSocket
sctpSCTPgqlGraphQL (v1+v2)
icmpICMPgqlv1 / gqlv2GraphQL version-specific
grpcgRPC (HTTP/2 sub-protocol)mongodbMongoDB
mysqlMySQLpostgresqlPostgreSQL
radiusRADIUS
diameterDiameterconn / flowL4 connection/flow tracking
tcp_conn / udp_connTransport-specific connections

Kubernetes Context

The most common starting point. Filter by where traffic originates or terminates.

Pod and Service Fields
src.pod.name == "orders-594487879c-7ddxf"
dst.pod.namespace == "production"
src.service.name == "api-gateway"
dst.service.namespace == "payments"

Pod fields fall back to service data when pod info is unavailable, so dst.pod.namespace works even for service-level entries.

Summary Name and Namespace

Convenience variables that pick the best available identity for a peer:

src.name == "api-gateway"                    // pod > service > dns > process
dst.name.contains("payment")                 // works across identity types
src.namespace == "production"                 // pod namespace, falls back to service
dst.namespace != "kube-system"               // exclude system namespace
Aggregate Collections

Match against any direction (src or dst):

"production" in namespaces           // Any namespace match
"orders" in pods                     // Any pod name match
"api-gateway" in services            // Any service name match
Labels and Annotations
map_get(local_labels, "app", "") == "checkout"   // Safe access with default
map_get(remote_labels, "version", "") == "canary"
"tier" in local_labels                            // Label existence check

Always use map_get() for labels and annotations — direct access like local_labels["app"] errors if the key doesn't exist.

Node and Process
node_name == "ip-10-0-25-170.ec2.internal"
local_process_name == "nginx"
remote_process_name.contains("postgres")
DNS Resolution
src.dns == "api.example.com"
dst.dns.contains("redis")

HTTP Filtering

HTTP is the most common protocol for API-level investigation.

Fields
FieldTypeExample
methodstring"GET", "POST", "PUT", "DELETE"
urlstringFull path + query: "/api/users?id=123"
pathstringPath only: "/api/users"
status_codeint200, 404, 500
http_versionstring"HTTP/1.1", "HTTP/2"
request.headersmaprequest.headers["content-type"]
response.headersmapresponse.headers["server"]
request.cookiesmaprequest.cookies["session"]
response.cookiesmapresponse.cookies["token"]
query_stringmapquery_string["id"]
request_body_sizeintRequest body bytes
response_body_sizeintResponse body bytes
elapsed_timeintDuration in microseconds
Common Patterns
// Error investigation
http && status_code >= 500                           // Server errors
http && status_code == 429                           // Rate limiting
http && status_code >= 400 && status_code < 500      // Client errors

// Endpoint targeting
http && method == "POST" && path.contains("/orders")
http && url.matches(".*/api/v[0-9]+/users.*")

// Performance
http && elapsed_time > 5000000                       // > 5 seconds
http && response_body_size > 1000000                 // > 1MB responses

// Header inspection
http && "authorization" in request.headers
http && request.headers["content-type"] == "application/json"

// GraphQL (subset of HTTP)
gql && method == "POST" && status_code >= 400

// Only eBPF-intercepted TLS traffic (decrypted HTTPS)
tls && http && status_code >= 500

Note on tls: The tls flag is an alias for capture_source == "ebpf_tls". It indicates traffic captured via eBPF TLS interception, not TLS protocol dissection.

Show full SKILL.md (248 more words)Show less

DNS Filtering

DNS issues are often the hidden root cause of outages.

FieldTypeDescription
dns_questions[]stringQuestion domain names
dns_answers[]stringAnswer domain names
dns_question_types[]stringRecord types: A, AAAA, CNAME, MX, TXT, SRV, PTR
dns_requestboolIs request
dns_responseboolIs response
dns_request_lengthintRequest size
dns_response_lengthintResponse size
dns && "api.external-service.com" in dns_questions
dns && dns_response && status_code != 0              // Failed lookups
dns && "A" in dns_question_types                     // A record queries
dns && size(dns_questions) > 1                       // Multi-question

Database and Messaging Protocols

Redis
redis && redis_type == "GET"                         // Command type
redis && redis_key.startsWith("session:")            // Key pattern
redis && redis_command.contains("DEL")               // Command search
redis && redis_total_size > 10000                    // Large operations
Kafka
kafka && kafka_api_key_name == "PRODUCE"             // Produce operations
kafka && kafka_client_id == "payment-processor"      // Client filtering
kafka && kafka_request_summary.contains("orders")    // Topic filtering
kafka && kafka_size > 10000                          // Large messages
MongoDB
mongodb && mongodb_command == "find"                  // Find operations
mongodb && mongodb_collection == "users"              // Collection filtering
mongodb && mongodb_database == "mydb"                 // Database filtering
mongodb && !mongodb_success                           // Failed operations
mongodb && mongodb_error_code != 0                    // Error code filtering
mongodb && mongodb_total_size > 10000                 // Large operations
MySQL
mysql && mysql_command == "COM_QUERY"                 // SQL queries
mysql && mysql_query.contains("SELECT")               // SELECT statements
mysql && mysql_database == "orders_db"                // Database filtering
mysql && !mysql_success                               // Failed queries
mysql && mysql_error_code != 0                        // Error code filtering
mysql && mysql_total_size > 10000                     // Large queries
PostgreSQL
postgresql && postgresql_command == "COM_QUERY"              // Query commands
postgresql && postgresql_query.contains("SELECT")            // SELECT statements
postgresql && postgresql_database == "orders_db"             // Database filtering
postgresql && postgresql_user == "admin"                     // User filtering
postgresql && !postgresql_success                            // Failed queries
postgresql && postgresql_error_code != ""                    // Error code filtering (SQLSTATE string)
postgresql && postgresql_total_size > 10000                  // Large queries

Note: postgresql_error_code is a string (SQLSTATE code like "23505"), not an int. This differs from MySQL's mysql_error_code which is an int.

gRPC

gRPC is a sub-protocol of HTTP/2. All HTTP variables are also available on gRPC entries.

grpc && grpc_method == "SayHello"                     // Method filtering
grpc && grpc_status != 0                              // Non-OK status codes
grpc && grpc_status == 14                             // UNAVAILABLE
grpc && grpc_method.contains("Create")                // Method pattern
grpc && elapsed_time > 1000000                        // Slow gRPC calls (>1s)
AMQP, LDAP, RADIUS, Diameter
amqp && amqp_method == "basic.publish"               // AMQP publish
ldap && ldap_type == "bind"                          // LDAP bind requests
radius && radius_code_name == "Access-Request"       // RADIUS auth
diameter && diameter_method.contains("Credit")       // Diameter credit control

For the full variable list for these protocols, see references/kfl2-reference.md.

Transport Layer (L4)

TCP/UDP Fields
tcp && tcp_error_type != ""                          // TCP errors
udp && udp_length > 1000                             // Large UDP packets
Connection Tracking
conn && conn_state == "open"                         // Active connections
conn && conn_local_bytes > 1000000                   // High-volume
conn && "HTTP" in conn_l7_detected                   // L7 protocol detection
tcp_conn && conn_state == "closed"                   // Closed TCP connections
Flow Tracking (with Rate Metrics)
flow && flow_local_pps > 1000                        // High packet rate
flow && flow_local_bps > 1000000                     // High bandwidth
flow && flow_state == "closed" && "TLS" in flow_l7_detected
tcp_flow && flow_local_bps > 5000000                 // High-throughput TCP

Network Layer

src.ip == "10.0.53.101"
dst.ip.startsWith("192.168.")
src.port == 8080
dst.port >= 8000 && dst.port <= 9000

Time-Based Filtering

timestamp > timestamp("2026-03-14T22:00:00Z")
timestamp >= timestamp("2026-03-14T22:00:00Z") && timestamp <= timestamp("2026-03-14T23:00:00Z")
timestamp > now() - duration("5m")                   // Last 5 minutes
elapsed_time > 2000000                               // Latency > 2 seconds

Building Filters: Progressive Narrowing

The most effective investigation technique — start broad, add constraints:

// Step 1: Protocol + namespace
http && dst.pod.namespace == "production"

// Step 2: Add error condition
http && dst.pod.namespace == "production" && status_code >= 500

// Step 3: Narrow to service
http && dst.pod.namespace == "production" && status_code >= 500 && dst.service.name == "payment-service"

// Step 4: Narrow to endpoint
http && dst.pod.namespace == "production" && status_code >= 500 && dst.service.name == "payment-service" && path.contains("/charge")

// Step 5: Add timing
http && dst.pod.namespace == "production" && status_code >= 500 && dst.service.name == "payment-service" && path.contains("/charge") && elapsed_time > 2000000

Performance Tips

  1. Protocol flags first — http && ... is faster than ... && http
  2. startsWith/endsWith over contains — prefix/suffix checks are faster
  3. Specific ports before string ops — dst.port == 80 is cheaper than url.contains(...)
  4. Use map_get for labels — avoids errors on missing keys
  5. Keep filters simple — CEL short-circuits on &&, so put cheap checks first

Type Safety

KFL2 is statically typed. Common gotchas:

  • status_code is int, not string — use status_code == 200, not "200"
  • elapsed_time is in microseconds — 5 seconds = 5000000
  • timestamp requires timestamp() function — not a raw string
  • Map access on missing keys errors — use key in map or map_get() first
  • List membership uses value in list — not list.contains(value)

© kubeshark, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/kfl of kubeshark/kubeshark.

  • SKILL.md
  • references/kfl2-reference.md

Open the folder on GitHubat commit 2d8a22d

Compare with similar skills

Kubeshark KFL2 Filter Reference next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Kubeshark KFL2 Filter Reference compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Kubeshark KFL2 Filter Reference this skillkubeshark/kubeshark12k—~3.6kAutomated safety check: PassApache-2.0
Platform Engineeringmagnus919/agent-skills111—~2.4kAutomated safety check: PassMIT
Intrinsic Core Debuggingintrinsic-ai/intrinsic-core552—~3.8kAutomated safety check: NotesApache-2.0
Kratos Developmentaide-family/moon253—~1.5kAutomated safety check: PassNone
Nginx To Higress Migrationhigress-group/higress9.5k—~3.9kAutomated safety check: PassApache-2.0
NGINX Ingress Controller Feature Checklistsnginx/kubernetes-ingress5.1k—~1.4kAutomated safety check: PassApache-2.0

Similar skills

  • Platform Engineering

    magnus919/agent-skills

    A skill your agent uses when building or operating internal developer platforms: infrastructure as code, CI/CD, container orchestration, service networking, secrets, and observability, or when…

    111 GitHub stars~2.4k tokensUpdated today
    DevOps & CloudAuto-check passed

  • Intrinsic Core Debugging

    intrinsic-ai/intrinsic-core

    Meta-level debugging workflows, architectural layer isolation, and progressive disclosure routing across Envoy ingress, Kubernetes pods, Behavior Trees, ObjectWorld synchronization, ICON real-time…

    552 GitHub stars~3.8k tokensUpdated today
    DevOps & CloudAuto-check: notes

  • Kratos Development

    aide-family/moon

    Develops Go microservices with Kratos v2 following official design philosophy, DDD/Clean Architecture layout, Protobuf API, error/config/middleware patterns, and observability.

    253 GitHub stars~1.5k tokensUpdated 3 mo ago
    Backend & APIsAuto-check passed

  • Nginx To Higress Migration

    higress-group/higress

    Migrate from ingress-nginx to Higress in Kubernetes environments.

    9.5k GitHub stars~3.9k tokensUpdated 2 days ago
    DevOps & CloudAuto-check passed

  • NGINX Ingress Controller Feature Checklists

    nginx/kubernetes-ingress

    Gives step-by-step checklists for adding Ingress annotations, VirtualServer fields and Helm values to the NGINX Kubernetes Ingress Controller, with common gotchas.

    5.1k GitHub stars~1.4k tokensUpdated today
    DevOps & CloudAuto-check passed

  • NGINX Ingress Policy CRD Guide

    nginx/kubernetes-ingress

    Step-by-step checklist for adding a new Policy CRD type to the NGINX Ingress Controller, from the Go types and validation to config generation and templates.

    5.1k GitHub stars~2k tokensUpdated today
    DevOps & CloudAuto-check passed

More from kubeshark/kubeshark

  • Kubeshark Installer

    kubeshark/kubeshark

    Installs and configures Kubeshark on a Kubernetes cluster, choosing between the quick CLI path and a Helm install with custom values.

    12k GitHub stars~3.6k tokensUpdated 6 days ago
    Auto-check: notes

  • Kubernetes Network Root Cause Analysis

    kubeshark/kubeshark

    Investigates past Kubernetes incidents from Kubeshark traffic snapshots: takes captures, dissects API calls, extracts PCAPs and compares traffic over time.

    12k GitHub stars~5.3k tokensUpdated 6 days ago
    Auto-check passed

  • Kubernetes Network Security Audit

    kubeshark/kubeshark

    Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

    12k GitHub stars~7.3k tokensUpdated 6 days ago
    Auto-check: notes

Works with

Categories

Questions about Kubeshark KFL2 Filter Reference

What does Kubeshark KFL2 Filter Reference do?

Syntax reference for KFL2, the CEL-based display filter language used to search Kubernetes network traffic captured by Kubeshark, loaded before any filter is written. KFL2 is built on Google's Common Expression Language and works as a display filter: it changes what you see, not what Kubeshark captures. The skill makes the agent write filters from the reference instead of guessing, since the language is statically typed and a wrong field name or syntax error fails silently or raises an error.

When should I use Kubeshark KFL2 Filter Reference?

Kubeshark KFL2 Filter Reference fits situations like: writing a filter to show only failing HTTP responses in a namespace; narrowing captured traffic by pod, service, label or annotation; searching for DNS lookups, Redis commands or Kafka topics in cluster traffic; building time-bounded traffic queries during an incident.

How do I install Kubeshark KFL2 Filter Reference in Claude Code?

Run `npx skills add kubeshark/kubeshark --skill kfl -a claude-code`. Or copy the skill folder (skills/kfl in kubeshark/kubeshark) into .claude/skills/kfl in your project. Claude Code loads it when a task matches its description.

How do I install Kubeshark KFL2 Filter Reference in Codex?

Run `npx skills add kubeshark/kubeshark --skill kfl -a codex`. Or copy the skill folder (skills/kfl in kubeshark/kubeshark) into .agents/skills/kfl in your project. Codex loads it when a task matches its description.

Can I use Kubeshark KFL2 Filter Reference in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add kubeshark/kubeshark --skill kfl -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/kfl, .gemini/skills/kfl, .github/skills/kfl and .opencode/skills/kfl in your project.

What does Kubeshark KFL2 Filter Reference need to run?

Going by SKILL.md and its folder, Kubeshark KFL2 Filter Reference needs the command-line tools its instructions call (mysql). Our summary lists: A Kubeshark deployment capturing cluster traffic.

Does Kubeshark KFL2 Filter Reference access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Kubeshark KFL2 Filter Reference safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Kubeshark KFL2 Filter Reference use?

Kubeshark KFL2 Filter Reference is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Kubeshark KFL2 Filter Reference use?

About 3.6k tokens (SKILL.md is roughly 14k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 5.4k tokens, read only when the agent opens those files.

What are the alternatives to Kubeshark KFL2 Filter Reference?

Skills that share tags, products or a category with Kubeshark KFL2 Filter Reference: Platform Engineering (magnus919/agent-skills, 111 stars), Intrinsic Core Debugging (intrinsic-ai/intrinsic-core, 552 stars), Kratos Development (aide-family/moon, 253 stars) and Nginx To Higress Migration (higress-group/higress, 9.5k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Kubeshark KFL2 Filter Reference?

kubeshark (a GitHub organization) maintains it in kubeshark/kubeshark, which has 12,094 GitHub stars. The repository holds 4 skills in this directory. The repository was last updated on September 30, 2026.

Source: kubeshark/kubeshark on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.