KubeShark for Kubernetes
LukasNiessen/kubernetes-skill
Keeps Kubernetes manifests, Helm charts and policies grounded by diagnosing six failure modes, such as insecure defaults and API drift, and loading only matching references.
Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift.
Install Defender For Containers
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-containers --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/defender-for-containers .claude/skills/defender-for-containers && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "defender-for-containers" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-containers into .claude/skills/defender-for-containers/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-containers", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-containersType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-containers --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/defender-for-containers .agents/skills/defender-for-containers && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "defender-for-containers" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-containers into .agents/skills/defender-for-containers/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-containers", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-containers --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/defender-for-containers .cursor/skills/defender-for-containers && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "defender-for-containers" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-containers into .cursor/skills/defender-for-containers/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-containers", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/vinayaklatthe/microsoft-security-skills.git --path skills/defender-for-containers--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-containers --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/defender-for-containers .gemini/skills/defender-for-containers && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "defender-for-containers" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-containers into .gemini/skills/defender-for-containers/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-containers", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-containersInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/defender-for-containers .github/skills/defender-for-containers && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "defender-for-containers" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-containers into .github/skills/defender-for-containers/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-containers", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-containers --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/defender-for-containers .opencode/skills/defender-for-containers && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "defender-for-containers" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-containers into .opencode/skills/defender-for-containers/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-containers", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
defender-for-containers- GitHub stars
- 175
- Token cost
- ~2.1k tokens
- SKILL.md length
- 839 words
- Files
- 1
- Skills in repo
- 50
- Repo updated
- First seen
- Licence
- MIT
At a glance
Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift.
- Works in 8 steps: Enable Defender for Containers at… → Connect non-Azure clusters via Arc.… → Registry scanning posture. Turn on… → …
- VM/host hardening (use defender-for-servers)
- SKILL.md covers When to use, Capability map, Approach and Guardrails, plus 3 more sections
- Calls kubectl
What it does
Defender For Containers is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift. Covers agentless discovery, agentless vulnerability assessment for images and running containers (powered by Microsoft Defender Vulnerability Management), runtime threat detection via the Defender sensor (eBPF on Linux), Kubernetes data plane hardening with Azure Policy / Gatekeeper, registry scanning for ACR / ECR / GAR, admission control, attack path analysis, and…
Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in DevOps & Cloud, covering Vulnerability scanning, Container orchestration and Network security. It works with Kubernetes, Microsoft Defender, Microsoft Azure and Google Kubernetes Engine. The repository describes itself as: Curated Microsoft Security skills for AI agents - Defender, Sentinel, Entra, Purview, Intune, Security Copilot. The licence is MIT.
When your agent uses it
- VM/host hardening (use defender-for-servers)
- AKS networking design (use azure-network-security-design)
- General AKS day-2 ops unrelated to security
Example prompts
- “/defender-for-containers”
Requirements
- Docker
Workflow steps
8 steps, taken from the first numbered list in SKILL.md.
- Enable Defender for Containers at subscription scope. Auto-provisioning installs
- Connect non-Azure clusters via Arc. EKS/GKE need a connector at the AWS/GCP cloud
- Registry scanning posture. Turn on continuous scanning so newly-disclosed CVEs
- Image vuln management at the pipeline. Don't wait for runtime: integrate the same
- Runtime threat detection — sensor or agentless?
- Admission control with Azure Policy / Gatekeeper. Roll out as audit for 14 days,
- Attack path analysis — review weekly. The high-value paths to fix first are
- Stream alerts to Sentinel via the Defender for Cloud connector. Build hunting queries
What it can do on your machine
Read from SKILL.md and the folder at commit 15f16df. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
kubectl
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
learn.microsoft.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Defender For Containers loads about 2.1k tokens when it runs. Until then it costs about 260 tokens; SKILL.md has 839 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from vinayaklatthe/microsoft-security-skills at commit 15f16df, republished under its MIT licence (© vinayaklatthe). 839 words, ~2,077 tokens.
Download SKILL.mdSave it as
.claude/skills/defender-for-containers/SKILL.md (or your agent's skills folder).- name
- defender-for-containers
- description
- Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift. Covers agentless discovery, agentless vulnerability assessment for images and running containers (powered by Microsoft Defender Vulnerability Management), runtime threat detection via the Defender sensor (eBPF on Linux), Kubernetes data plane hardening with Azure Policy / Gatekeeper, registry scanning for ACR / ECR / GAR, admission control, attack path analysis, and Sentinel integration. WHEN: Defender for Containers, AKS security, container runtime threat detection, Kubernetes admission control, image vulnerability scanning, ACR scan, EKS GKE security in Defender for Cloud, K8s posture, container attack path, Defender container sensor, Gatekeeper Azure Policy AKS, agentless container scan. DO NOT USE for VM/host hardening (use defender-for-servers), AKS networking design (use azure-network-security-design), or general AKS day-2 ops unrelated to security.
- license
- MIT
- metadata.author
- Microsoft
- metadata.version
- 0.1.0
Microsoft Defender for Containers
Defender for Containers is the Kubernetes-aware plan in Microsoft Defender for Cloud. It covers AKS, Azure Arc-enabled Kubernetes (on-prem, EKS, GKE, OpenShift), and the container registries that feed them, providing posture, image vulnerability assessment, runtime threat detection, and admission control.
When to use
Securing Kubernetes clusters and the registries that supply them. Use this skill for plan rollout, sensor vs agentless trade-offs, registry scanning, admission policy design, and runtime alert response.
Do not use this skill for VM/host hardening (defender-for-servers), cluster
networking design (azure-network-security-design), or generic AKS operations (azure-kubernetes).
Capability map
| Capability | How it works | Coverage |
|---|---|---|
| Agentless discovery | API-based cluster inventory, control-plane misconfig, K8s API audit log analytics | AKS, EKS, GKE, Arc |
| Agentless vulnerability assessment | Snapshots node disks; scans images in registries and running containers | AKS, EKS, GKE |
| Registry scanning | Pull-time, push-time, and continuous scan of images | ACR, ECR, GAR |
| Runtime threat detection | Defender sensor (DaemonSet, eBPF on Linux) — fileless, lateral movement, crypto-miner detections | AKS, Arc, EKS, GKE |
| Kubernetes data plane hardening | Azure Policy add-on (OPA/Gatekeeper) | AKS, Arc-enabled K8s |
| Attack path analysis | Combines posture + vuln + runtime to surface internet → pod → cloud-IAM paths | All |
Approach
Enable Defender for Containers at subscription scope. Auto-provisioning installs:
- Defender sensor (DaemonSet) for runtime detection on Linux nodes.
- Azure Policy for Kubernetes add-on for admission control.
- Connects ACR scanning automatically.
Verify:
kubectl get ds -n kube-systemshowsmicrosoft-defender-collector-ds; AKS shows Defender profile = enabled.
Connect non-Azure clusters via Arc. EKS/GKE need a connector at the AWS/GCP cloud account level + Arc onboarding for runtime sensor (agentless features work without sensor).
Registry scanning posture. Turn on continuous scanning so newly-disclosed CVEs raise findings on already-pushed images, not just at push time. Set retention so you can answer "is image X vulnerable to CVE-Y" 90 days later.
Image vuln management at the pipeline. Don't wait for runtime: integrate the same MDVM API into CI to fail builds on critical, exploitable CVEs. Pair with image signing (Notation / cosign) and admission control to require signed images.
Runtime threat detection — sensor or agentless?
- Sensor required for: fileless attacks, process tree, in-memory exploitation, lateral movement, reverse shell.
- Agentless covers: image vuln, posture, K8s API audit-based detections.
- Use both in production. Sensor only on Linux node pools (Windows runtime sensor coverage is limited).
Admission control with Azure Policy / Gatekeeper. Roll out as audit for 14 days, then deny. Baseline policies:
- No privileged containers.
- No
hostPathmounts to sensitive paths. - Required readOnlyRootFilesystem for app workloads.
- Required resource limits.
- Required signed images (allowlist registries).
Attack path analysis — review weekly. The high-value paths to fix first are internet-exposed pod with critical CVE → workload identity → cloud IAM. Prioritise by blast radius, not finding count.
Stream alerts to Sentinel via the Defender for Cloud connector. Build hunting queries on
SecurityAlertfiltered to ProductName = "Microsoft Defender for Containers".
Show full SKILL.md (370 more words)Show less
Guardrails
- Defender sensor is required for runtime detection. Agentless alone won't catch reverse shells or crypto miners running inside pods.
- Roll admission policies in audit first. A
requiredLabelspolicy in deny mode on day one will brick deployments. - Don't run two privileged DaemonSets that hook the kernel (e.g., Defender sensor + Falco + a third-party EDR) without testing — eBPF program collisions and node instability.
- ACR + private endpoint + Defender scanning needs careful network design. The scanner must reach the registry; verify private DNS resolution and trusted-services bypass.
- Don't scope plan to a single cluster's RG. New clusters in other RGs go unprotected. Subscription scope + policy enforcement.
- Windows containers have limited sensor coverage. Compensate with stricter admission control and image scanning for Windows workloads.
- Image vuln findings without exploitability context are noise. Always filter by exploitable / KEV before triage.
Common anti-patterns
- "Agentless only because the sensor adds 80 MB of RAM per node" — and you have no runtime detection. Budget the RAM.
- "Admission policy in deny on day one" — outage. 14-day audit, fix violations, then deny.
- "Image scanning at push only" — tomorrow's CVE on yesterday's image goes unflagged. Continuous scanning on.
- "CI ignores MDVM findings — we'll catch it at runtime" — vulnerabilities reach prod; rollback is expensive. Fail the build on critical exploitable.
- "All clusters in scope, no exemptions for sandbox" — alert volume buries real incidents. Tag/scope sandbox out of admission deny + alert routing.
- "Used Defender for Containers for VM hosts running Docker directly" — wrong tool;
that's a
defender-for-serversscenario. - "Skipped Arc for EKS/GKE because connector is enough" — no runtime sensor, no eBPF detections.
Example prompts
Enable Defender for Containers across 5 subs with AKS clusters; pilot on dev for 7 days.Roll out Azure Policy for Kubernetes admission control — baseline policy set in audit.Connect 3 EKS clusters via Arc and enable runtime sensor.Build a CI gate that fails on critical exploitable CVEs from MDVM.Investigate a "Crypto-mining activity in container" alert — runbook + KQL.Tune attack path analysis to surface only internet-to-cloud-IAM paths.Design admission control to require signed images from approved ACRs only.
Microsoft Learn
- Overview: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction
- Enable plan: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable
- Architecture: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-architecture
- Vulnerability assessment: https://learn.microsoft.com/azure/defender-for-cloud/agentless-vulnerability-assessment-azure
- Runtime detection alerts: https://learn.microsoft.com/azure/defender-for-cloud/alerts-reference#alerts-k8scluster
- Azure Policy for Kubernetes: https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes
- EKS / GKE protection: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable?pivots=defender-for-container-eks
- Attack path analysis: https://learn.microsoft.com/azure/defender-for-cloud/concept-attack-path
© vinayaklatthe, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/defender-for-containers of vinayaklatthe/microsoft-security-skills.
Open the folder on GitHubat commit 15f16df
Compare with similar skills
Defender For Containers next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Defender For Containers this skillvinayaklatthe/microsoft-security-skills | 175 | — | ~2.1k | Automated safety check: Pass | MIT | |
| KubeShark for KubernetesLukasNiessen/kubernetes-skill | 446 | — | ~1.2k | Automated safety check: Pass | MIT | |
| Alibabacloud Ecs Sec Userspacealiyun/alibabacloud-ecs-troubleshoot-skills | 148 | — | ~2.6k | Automated safety check: Notes | Apache-2.0 | |
| Performing Container Security Scanning With Trivymukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~818 | Automated safety check: Pass | Apache-2.0 | |
| Kcli Cluster Deploymentkarmab/kcli | 653 | — | ~1.5k | Automated safety check: Pass | Apache-2.0 | |
| Ama Logs Update Charts Release Notesmicrosoft/Docker-Provider | 174 | — | ~2.6k | Automated safety check: Pass | Custom licence |
Similar skills
Alibabacloud Ecs Sec Userspace
aliyun/alibabacloud-ecs-troubleshoot-skills
Linux 用户态安全入侵检测与取证工具，专为 AI Agent 设计。自动判断服务器是否被入侵， 提供完整证据链和可执行修复建议。51 个安全分析器覆盖进程/网络/认证/持久化/Rootkit/ 恶意软件/内存取证/容器逃逸等 12 类检测维度，10 个数据采集器全面采集系统状态， 映射 103+ MITRE ATT&CK 技术，支持 standalone/docker/k8s 三种部署模式。
Performing Container Security Scanning With Trivy
mukul975/Anthropic-Cybersecurity-Skills
Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…
Kcli Cluster Deployment
karmab/kcli
Guides deployment and management of Kubernetes clusters with kcli.
- Official
Ama Logs Update Charts Release Notes
microsoft/Docker-Provider
Prepare an ama-logs release PR: bump the image tag (X.Y.Z) across Helm charts, manifests, and Dockerfiles, and add a formatted ReleaseNotes.md entry.
Cloud Audit
CommonHuman-Lab/nyxstrike
Cloud and container security auditing workflow using prowler, trivy, kube-hunter, and docker-bench for AWS, GCP, Azure, Kubernetes, and container images
More from vinayaklatthe/microsoft-security-skills
All 50 skills in this repoAPI Security Design
vinayaklatthe/microsoft-security-skills
Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…
Azure App Service Security
vinayaklatthe/microsoft-security-skills
Guidance for securing Azure App Service web apps and APIs — managed identity, Easy Auth with Microsoft Entra ID, network isolation via private endpoints + VNet integration, HTTPS / TLS hardening…
Azure Arc
vinayaklatthe/microsoft-security-skills
Guidance for Azure Arc — projecting on-premises, multicloud (AWS/GCP), and edge servers, Kubernetes, and data services into Azure Resource Manager for unified governance, security, and management.
Azure Bastion Jit
vinayaklatthe/microsoft-security-skills
Guidance for secure remote VM management in Azure using Azure Bastion combined with Defender for Cloud just-in-time (JIT) VM access.
Azure Confidential Computing
vinayaklatthe/microsoft-security-skills
Guidance for Azure Confidential Computing — protecting data in use through hardware-based Trusted Execution Environments (TEEs).
Azure Ddos Protection
vinayaklatthe/microsoft-security-skills
Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform.
Related
Categories
Questions about Defender For Containers
What does Defender For Containers do?
Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift. Defender For Containers is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift.
When should I use Defender For Containers?
Defender For Containers fits situations like: VM/host hardening (use defender-for-servers); AKS networking design (use azure-network-security-design); general AKS day-2 ops unrelated to security.
How do I install Defender For Containers in Claude Code?
Run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a claude-code`. Or copy the skill folder (skills/defender-for-containers in vinayaklatthe/microsoft-security-skills) into .claude/skills/defender-for-containers in your project. Claude Code loads it when a task matches its description.
How do I install Defender For Containers in Codex?
Run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a codex`. Or copy the skill folder (skills/defender-for-containers in vinayaklatthe/microsoft-security-skills) into .agents/skills/defender-for-containers in your project. Codex loads it when a task matches its description.
Can I use Defender For Containers in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/defender-for-containers, .gemini/skills/defender-for-containers, .github/skills/defender-for-containers and .opencode/skills/defender-for-containers in your project.
What does Defender For Containers need to run?
Going by SKILL.md and its folder, Defender For Containers needs the command-line tools its instructions call (kubectl). Our summary lists: Docker.
Does Defender For Containers access the network?
SKILL.md names 1 domain. As links in the text: learn.microsoft.com. This is read from the text; nothing was executed.
Is Defender For Containers safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Defender For Containers use?
Defender For Containers is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Defender For Containers use?
About 2.1k tokens (SKILL.md is roughly 8.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Defender For Containers?
Skills that share tags, products or a category with Defender For Containers: KubeShark for Kubernetes (LukasNiessen/kubernetes-skill, 446 stars), Alibabacloud Ecs Sec Userspace (aliyun/alibabacloud-ecs-troubleshoot-skills, 148 stars), Performing Container Security Scanning With Trivy (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Kcli Cluster Deployment (karmab/kcli, 653 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Defender For Containers?
vinayaklatthe (a GitHub user) maintains it in vinayaklatthe/microsoft-security-skills, which has 175 GitHub stars. The repository holds 50 skills in this directory. The repository was last updated on June 18, 2026.
Source: vinayaklatthe/microsoft-security-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.