Stats
Actions
Tags
From k8s-security
Review and harden Kubernetes workloads (pods/Deployments) against Pod Security Standards — privileged containers, host namespaces, hostPath, capabilities, securityContext, and admission enforcement. Use to assess or fix pod-level security for a workload or namespace.
How this skill is triggered — by the user, by Claude, or both
Slash command
/k8s-security:k8s-workload-hardeningThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Workloads that meet the Pod Security Standards (baseline → restricted), with
Workloads that meet the Pod Security Standards (baseline → restricted), with dangerous settings removed and enforcement guaranteed by admission, not just policy on paper.
privileged: true; allowPrivilegeEscalation: false;
runAsNonRoot: true, non-zero runAsUser.hostNetwork/hostPID/hostIPC; no hostPath mounts; no
host ports.drop: ["ALL"], add back only what's required; no SYS_ADMIN/
NET_ADMIN unless justified.readOnlyRootFilesystem: true; writable paths via emptyDir/
volumes.seccompProfile: RuntimeDefault (or stricter); AppArmor
where available.sast-sca).A hardening table: workload · setting · current · required · severity · fix, plus
corrected manifest snippets and the namespace admission level to enforce. Confirmed
issues → security-reporting:finding.
A privileged or hostPath-mounted container is a node-takeover and often cluster-admin path — treat those as the top severities. Hardening the pod is only durable if admission enforces the standard; verify enforcement, don't assume it.
Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub jassics/awesome-claude-security --plugin k8s-security