New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Performing Kubernetes Etcd Security Assessment

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation.

Apache-2.0Auto-check passedDevOps & Cloud

Install Performing Kubernetes Etcd Security Assessment

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-kubernetes-etcd-security-assessment -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills performing-kubernetes-etcd-security-assessment --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/performing-kubernetes-etcd-security-assessment .claude/skills/performing-kubernetes-etcd-security-assessment && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
performing-kubernetes-etcd-security-assessment
GitHub stars
34k
Token cost
~1.9k tokens
SKILL.md length
316 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation.

  • Works in 5 steps: Encryption at Rest → TLS Transport Security → Access Control → …
  • Hardening a control plane
  • SKILL.md covers Overview, When to Use, Prerequisites and Assessment Areas, plus 3 more sections
  • Runs Python scripts from its folder; calls openssl, kubectl and curl; needs NEW_KEY

What it does

Performing Kubernetes Etcd Security Assessment is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad…

Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in DevOps & Cloud, covering Container orchestration, Authorization and RBAC and Security review. It works with Kubernetes. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Hardening a control plane
  • Reviewing whether Secrets are encrypted at rest
  • Protecting etcd backups
  • Since etcd stores Secrets

Example prompts

  • “Use the performing-kubernetes-etcd-security-assessment skill to assess the security posture of the etcd cluster backing Kubernetes: encryption at…”
  • “/performing-kubernetes-etcd-security-assessment”

Requirements

  • Python 3
  • A credential in NEW_KEY

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Encryption at Rest
  2. TLS Transport Security
  3. Access Control
  4. Backup Security
  5. Network Isolation

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • openssl
    • kubectl
    • curl

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • kubernetes.io
    • cisecurity.org
    • k8s-security.geek-kb.com
    • infosecinstitute.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • NEW_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Performing Kubernetes Etcd Security Assessment loads about 1.9k tokens when it runs, and up to ~2.8k if it reads all its reference files. Until then it costs about 160 tokens; SKILL.md has 316 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~160
When it runs · the whole SKILL.md, loaded when a task matches
~1.9k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 316 words, ~1,880 tokens.

Download SKILL.mdSave it as .claude/skills/performing-kubernetes-etcd-security-assessment/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
performing-kubernetes-etcd-security-assessment
description
Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use performing-kubernetes-cis-benchmark-with-kube-bench.
domain
cybersecurity
subdomain
container-security
tags
kubernetes, etcd, encryption, tls, security-assessment, backup, secrets, control-plane
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
PR.PS-01, PR.IR-01, ID.AM-08, DE.CM-01
mitre_attack
T1610, T1611, T1609, T1525, T1573

Performing Kubernetes etcd Security Assessment

Overview

etcd is the distributed key-value store that serves as Kubernetes' backing store for all cluster data, including Secrets, RBAC policies, ConfigMaps, and workload configurations. Without proper hardening, etcd exposes all cluster secrets in plaintext, making it the highest-value target for attackers who gain control plane access. A comprehensive security assessment covers encryption at rest, TLS for transport, access control, backup security, and network isolation.

When to Use

  • When conducting security assessments that involve performing kubernetes etcd security assessment
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Access to Kubernetes control plane nodes
  • SSH access to etcd cluster nodes (or etcdctl configured)
  • CIS Kubernetes Benchmark reference document
  • Understanding of TLS certificate management and EncryptionConfiguration

Assessment Areas

1. Encryption at Rest

Verify that Kubernetes encrypts Secret data stored in etcd:

bash
# Check if EncryptionConfiguration is configured on API server
ps aux | grep kube-apiserver | grep encryption-provider-config

# View the encryption configuration
cat /etc/kubernetes/enc/encryption-config.yaml

Expected secure configuration:

yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
      - configmaps
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-encoded-32-byte-key>
      - identity: {}  # Fallback for reading unencrypted data

Verify secrets are actually encrypted in etcd:

bash
# Read a secret directly from etcd
ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  get /registry/secrets/default/my-secret | hexdump -C | head -20

# If encrypted, output starts with "k8s:enc:aescbc:v1:key1"
# If NOT encrypted, you'll see plaintext key-value pairs
2. TLS Transport Security
bash
# Verify etcd uses TLS for client connections
ETCDCTL_API=3 etcdctl endpoint health \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Check peer TLS configuration
ps aux | grep etcd | tr ' ' '\n' | grep -E "peer-cert|peer-key|peer-trusted-ca"

# Verify certificate expiration
openssl x509 -in /etc/kubernetes/pki/etcd/server.crt -noout -enddate
openssl x509 -in /etc/kubernetes/pki/etcd/peer.crt -noout -enddate

Expected flags:

FlagRequired ValuePurpose
--cert-filePath to server certClient-to-server TLS
--key-filePath to server keyClient-to-server TLS
--trusted-ca-filePath to CA certClient certificate validation
--peer-cert-filePath to peer certPeer-to-peer TLS
--peer-key-filePath to peer keyPeer-to-peer TLS
--peer-trusted-ca-filePath to peer CAPeer certificate validation
--client-cert-authtrueRequire client certificates
--peer-client-cert-authtrueRequire peer certificates
3. Access Control
bash
# Verify etcd is not exposed on all interfaces
ps aux | grep etcd | tr ' ' '\n' | grep listen-client-urls
# Should be: https://127.0.0.1:2379 (not 0.0.0.0)

# Check who can access etcd certificates
ls -la /etc/kubernetes/pki/etcd/
# Should be readable only by root/etcd user

# Verify API server is the only etcd client
ss -tlnp | grep 2379
# Only kube-apiserver should have connections
4. Backup Security
bash
# Create an encrypted etcd backup
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Encrypt the backup file
gpg --symmetric --cipher-algo AES256 /backup/etcd-snapshot.db

# Verify backup integrity
ETCDCTL_API=3 etcdctl snapshot status /backup/etcd-snapshot.db --write-out=table
5. Network Isolation
bash
# Verify etcd ports are firewalled
iptables -L -n | grep -E "2379|2380"

# Check if etcd is accessible from worker nodes (should NOT be)
# Run from a worker node:
curl -k https://<control-plane-ip>:2379/health
# Should be rejected/timeout

CIS Benchmark Checks

CIS ControlCheckExpected Result
2.1etcd cert-file setTLS certificate configured
2.2etcd client-cert-authClient certificate authentication enabled
2.3etcd auto-tls disabledauto-tls=false
2.4etcd peer cert-file setPeer TLS configured
2.5etcd peer client-cert-authPeer authentication enabled
2.6etcd peer auto-tls disabledpeer-auto-tls=false
2.7etcd unique CASeparate CA for etcd (not shared with cluster)

Key Rotation Procedure

bash
# 1. Generate new encryption key
NEW_KEY=$(head -c 32 /dev/urandom | base64)

# 2. Update EncryptionConfiguration with new key first
cat > /etc/kubernetes/enc/encryption-config.yaml <<EOF
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key2
              secret: ${NEW_KEY}
            - name: key1
              secret: <old-key>
      - identity: {}
EOF

# 3. Restart API server to pick up new config
# 4. Re-encrypt all secrets with new key
kubectl get secrets --all-namespaces -o json | \
  kubectl replace -f -

# 5. Remove old key from EncryptionConfiguration
# 6. Restart API server again

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/performing-kubernetes-etcd-security-assessment of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Performing Kubernetes Etcd Security Assessment next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Performing Kubernetes Etcd Security Assessment compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Performing Kubernetes Etcd Security Assessment this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.9kAutomated safety check: PassApache-2.0
Operating Kubernetesancoleman/ai-design-components525—~3.6kAutomated safety check: PassMIT
Operate Kubernetes Toolchaincyberful/cyberful135—~898Automated safety check: PassAGPL-3.0
KubeSphere Multi-Tenant Managementkubesphere/kubesphere17k—~3.1kAutomated safety check: PassCustom licence
Mirrord Operatormetalbear-co/mirrord5.4k1 repos~4.6kAutomated safety check: PassMIT
Kubernetes SpecialistJeffallan/claude-skills12k1 repos~2.1kAutomated safety check: PassMIT

Similar skills

  • Operating Kubernetes

    ancoleman/ai-design-components

    Operating production Kubernetes clusters effectively with resource management, advanced scheduling, networking, storage, security hardening, and autoscaling.

    525 GitHub stars~3.6k tokensUpdated 10 mo ago
    DevOps & CloudAuto-check passed

  • Operate Kubernetes Toolchain

    cyberful/cyberful

    Operate kubectl, kube-bench, Trivy, Prowler, and manifest/runtime evidence for advanced Kubernetes security assessment.

    135 GitHub stars~898 tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

  • KubeSphere Multi-Tenant Management

    kubesphere/kubesphere

    Creates and queries KubeSphere users, workspaces and projects and assigns built-in roles, defaulting to least privilege and never deleting anything.

    17k GitHub stars~3.1k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

  • Mirrord Operator

    metalbear-co/mirrord

    Help users install and configure the mirrord Operator for team/enterprise environments.

    5.4k GitHub starsUsed in 1 repo~4.6k tokens
    DevOps & CloudAuto-check passed

  • Kubernetes Specialist

    Jeffallan/claude-skills

    Creates and checks Kubernetes manifests, Helm charts, RBAC and network policies, and helps debug pod problems, with kubectl checks and rollback steps.

    12k GitHub starsUsed in 1 repo~2.1k tokens
    DevOps & CloudAuto-check passed

  • Documentation

    home-operations/kopiur

    How Kopiur writes and maintains user-facing docs — the MkDocs Material site under docs/ and the example manifests under deploy/examples/.

    115 GitHub stars~2.5k tokensUpdated today
    DevOps & CloudAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Performing Kubernetes Etcd Security Assessment

What does Performing Kubernetes Etcd Security Assessment do?

Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Performing Kubernetes Etcd Security Assessment is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation.

When should I use Performing Kubernetes Etcd Security Assessment?

Performing Kubernetes Etcd Security Assessment fits situations like: hardening a control plane; reviewing whether Secrets are encrypted at rest; protecting etcd backups; since etcd stores Secrets.

How do I install Performing Kubernetes Etcd Security Assessment in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-kubernetes-etcd-security-assessment -a claude-code`. Or copy the skill folder (skills/performing-kubernetes-etcd-security-assessment in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/performing-kubernetes-etcd-security-assessment in your project. Claude Code loads it when a task matches its description.

How do I install Performing Kubernetes Etcd Security Assessment in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-kubernetes-etcd-security-assessment -a codex`. Or copy the skill folder (skills/performing-kubernetes-etcd-security-assessment in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/performing-kubernetes-etcd-security-assessment in your project. Codex loads it when a task matches its description.

Can I use Performing Kubernetes Etcd Security Assessment in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-kubernetes-etcd-security-assessment -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/performing-kubernetes-etcd-security-assessment, .gemini/skills/performing-kubernetes-etcd-security-assessment, .github/skills/performing-kubernetes-etcd-security-assessment and .opencode/skills/performing-kubernetes-etcd-security-assessment in your project.

What does Performing Kubernetes Etcd Security Assessment need to run?

Going by SKILL.md and its folder, Performing Kubernetes Etcd Security Assessment needs Python for the scripts in its folder, the command-line tools its instructions call (openssl, kubectl and curl) and credentials named NEW_KEY. Our summary lists: Python 3; A credential in NEW_KEY.

Does Performing Kubernetes Etcd Security Assessment access the network?

SKILL.md names 4 domains. As links in the text: kubernetes.io, cisecurity.org, k8s-security.geek-kb.com and infosecinstitute.com. This is read from the text; nothing was executed.

Is Performing Kubernetes Etcd Security Assessment safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Performing Kubernetes Etcd Security Assessment use?

Performing Kubernetes Etcd Security Assessment is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Performing Kubernetes Etcd Security Assessment use?

About 1.9k tokens (SKILL.md is roughly 7.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 881 tokens, read only when the agent opens those files.

What are the alternatives to Performing Kubernetes Etcd Security Assessment?

Skills that share tags, products or a category with Performing Kubernetes Etcd Security Assessment: Operating Kubernetes (ancoleman/ai-design-components, 525 stars), Operate Kubernetes Toolchain (cyberful/cyberful, 135 stars), KubeSphere Multi-Tenant Management (kubesphere/kubesphere, 17k stars) and Mirrord Operator (metalbear-co/mirrord, 5.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Performing Kubernetes Etcd Security Assessment?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.