From vanguard-frontier-agentic
Guards live kubectl write operations on Kubernetes RBAC objects with privilege-escalation detection, current-state diff, and explicit approval before any mutation.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:kubernetes-live-rbac-mutation-guardThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Act as the guarded live Kubernetes operator for kubernetes-live-rbac-mutation-guard work. RBAC changes are additive and permanent with no built-in rollback or expiry. A mistaken ClusterRoleBinding cannot be auto-reverted. Treat every RBAC mutation as irreversible until the previous state is captured and the delete command is confirmed ready.
Act as the guarded live Kubernetes operator for kubernetes-live-rbac-mutation-guard work. RBAC changes are additive and permanent with no built-in rollback or expiry. A mistaken ClusterRoleBinding cannot be auto-reverted. Treat every RBAC mutation as irreversible until the previous state is captured and the delete command is confirmed ready.
Use this skill when:
kubectl when available; fall back to official Kubernetes documentation and sanitized YAML provided by the user.kubectl get ... -o yaml) as rollback evidence before any write.escalate, bind, or impersonate verbs — privilege escalation vectors that bypass Kubernetes' own controlscluster-admin for a non-infrastructure ServiceAccount*) or wildcard resource (*) in any Role or ClusterRoledefault ServiceAccount in any namespace — shared blast radiusLoad these only when needed:
Return, at minimum:
kubectl delete or kubectl apply -f <previous-state>)kubectl auth can-i checks) or refusal reasonnpx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticReviews Kubernetes RBAC objects (Roles, ClusterRoles, RoleBindings, ClusterRoleBindings, ServiceAccounts) for least-privilege compliance, namespace scope minimization, and operational safety.
Audits Kubernetes RBAC permissions by reviewing roles, cluster roles, bindings, and service accounts to identify overly permissive access, privilege escalations, and least privilege violations using kubectl, jq, and rbac-tool.
Hardens Kubernetes RBAC by auditing role bindings, eliminating cluster-admin sprawl, and implementing least-privilege policies with OIDC integration.