[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADX8JQHY3B1RQHJAPWFDN0":3,"skill-same:01M6ADX8JQHY3B1RQHJAPWFDN0":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6ADX8JQHY3B1RQHJAPWFDN0","benchmarking-kubernetes-with-kube-bench",null,"Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbenchmarking-kubernetes-with-kube-bench\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"benchmarking kubernetes with kube bench","benchmarking","kubernetes","audit report","cluster-security","hardening","cis-benchmark","kube-bench","JSON Output","container-security","compliance","ci","integration","audit","control plane","report","benchmark","run","pr","cybersecurity","2026-11-10 10:12:30",false,"---\nname: benchmarking-kubernetes-with-kube-bench\ndescription: >-\n  Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or\n  standalone binary, selecting the correct benchmark version and targets (control plane, etcd,\n  kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting\n  kube-bench up for the first time, choosing which benchmark version and node targets to run,\n  wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench,\n  DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for\n  interpreting the findings or producing an audit report - use\n  performing-kubernetes-cis-benchmark-with-kube-bench.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- kubernetes\n- kube-bench\n- cis-benchmark\n- container-security\n- hardening\n- compliance\n- cluster-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\nmitre_attack:\n- T1610\n---\n# Benchmarking Kubernetes with kube-bench\n\n## Overview\n\nkube-bench (by Aqua Security) is an open-source tool that checks whether a Kubernetes cluster is deployed securely by running the checks documented in the **CIS Kubernetes Benchmark**. It inspects the control-plane components (API server, controller manager, scheduler, etcd), the kubelet and worker-node configuration, and cluster-wide policy settings, then reports each check as PASS, FAIL, WARN, or INFO with a remediation recommendation drawn directly from the CIS guidance. Tests are configuration-driven YAML files, so kube-bench tracks new Kubernetes versions and benchmark revisions and supports managed distributions (EKS, GKE, AKS, ACK, OpenShift, RKE, k3s).\n\nHardening a cluster against the CIS Benchmark directly reduces the attack surface for **T1610 (Deploy Container)**, where an adversary deploys a container to execute code or evade defenses — for example by abusing privileged containers, host namespaces, anonymous API access, or insecure kubelet settings that an unhardened cluster leaves exposed.\n\nkube-bench can run as a standalone binary on a node, inside a container, or — most commonly — as a Kubernetes Job whose pod has the host filesystem mounted so it can read the relevant config files. Output is available as human-readable text, JSON, JUnit, or AWS Security Finding Format (ASFF) and can be pushed to a PostgreSQL database for trend tracking.\n\n## When to Use\n\n- When establishing a security baseline for a new Kubernetes cluster against the CIS Kubernetes Benchmark.\n- When performing periodic compliance audits of control-plane and node hardening.\n- When validating remediation after applying hardening changes (re-run to confirm checks now PASS).\n- When integrating cluster compliance scanning into CI\u002FCD or a continuous monitoring pipeline.\n- When preparing evidence for SOC 2, PCI DSS, or internal hardening compliance.\n\n## Prerequisites\n\n- Access to the cluster: either SSH access to a control-plane\u002Fworker node (binary mode) or `kubectl` with permission to create Jobs (in-cluster mode).\n- Knowledge of the cluster's Kubernetes version (kube-bench auto-detects, or specify with `--version` \u002F `--benchmark`).\n- Install kube-bench (Aqua Security official methods):\n\n```bash\n# Binary release (Linux)\nKB_VERSION=0.10.7\ncurl -L -o kube-bench.tgz \\\n  \"https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench\u002Freleases\u002Fdownload\u002Fv${KB_VERSION}\u002Fkube-bench_${KB_VERSION}_linux_amd64.tar.gz\"\ntar -xzf kube-bench.tgz\nsudo mv kube-bench \u002Fusr\u002Flocal\u002Fbin\u002F\nsudo cp -R cfg \u002Fetc\u002Fkube-bench\u002Fcfg\n\n# Via Go install\ngo install github.com\u002Faquasecurity\u002Fkube-bench@latest\n\n# Run as a one-off container directly on a node (mounts host config)\ndocker run --rm --pid=host \\\n  -v \u002Fetc:\u002Fetc:ro -v \u002Fvar:\u002Fvar:ro \\\n  -t docker.io\u002Faquasec\u002Fkube-bench:latest run --targets node\n\n# Verify\nkube-bench version\n```\n\n## Objectives\n\n- Run kube-bench against the appropriate benchmark for the cluster's Kubernetes version.\n- Scan control-plane (master), node, etcd, control-plane policies, and managed-service targets.\n- Produce machine-readable JSON\u002FJUnit output for pipelines and dashboards.\n- Triage FAIL and WARN results and apply CIS remediation guidance.\n- Re-run to validate that remediations now PASS.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1610 | Deploy Container | Execution \u002F Defense Evasion | CIS Benchmark hardening enforced by kube-bench restricts privileged\u002Fhost-namespace deployments, anonymous API access, and insecure kubelet settings that adversaries abuse when deploying malicious containers. |\n\n## Workflow\n\n### 1. Run the default scan (auto-detect)\n\nRun all applicable targets, letting kube-bench detect the Kubernetes version and benchmark:\n\n```bash\nsudo kube-bench\n```\n\n### 2. Run as a Kubernetes Job (in-cluster)\n\nApply the provided Job manifest from the kube-bench repo and read the results from the pod logs:\n\n```bash\n# General-purpose job\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Fkube-bench\u002Fmain\u002Fjob.yaml\n\n# Wait, then retrieve results\nkubectl get pods -l app=kube-bench\nkubectl logs -l app=kube-bench\n\n# Platform-specific jobs are available, e.g. EKS:\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Fkube-bench\u002Fmain\u002Fjob-eks.yaml\n```\n\n### 3. Target specific components\n\nUse `run --targets` to scope the scan to particular component groups:\n\n```bash\n# Control-plane (API server, scheduler, controller manager)\nsudo kube-bench run --targets master\n\n# Worker node (kubelet, proxy)\nsudo kube-bench run --targets node\n\n# etcd datastore\nsudo kube-bench run --targets etcd\n\n# Cluster-wide policies (RBAC, pod security, network policy)\nsudo kube-bench run --targets policies\n\n# Combine multiple targets\nsudo kube-bench run --targets master,node,etcd,policies\n```\n\n### 4. Pin a specific benchmark or Kubernetes version\n\nWhen auto-detection is wrong or you must audit against a specific revision, pin the benchmark explicitly:\n\n```bash\n# Pin to a specific CIS benchmark revision\nsudo kube-bench run --benchmark cis-1.8\n\n# Or map by Kubernetes version\nsudo kube-bench --version 1.27\n\n# Managed\u002Fdistribution-specific benchmarks\nsudo kube-bench run --benchmark eks-1.5.0\nsudo kube-bench run --benchmark gke-1.6.0\nsudo kube-bench run --benchmark rke2-cis-1.7\n```\n\n### 5. Run or skip individual checks\n\nFocus on or exclude specific check IDs during remediation cycles:\n\n```bash\n# Run only specific checks\nsudo kube-bench run --targets master --check 1.2.1,1.2.2\n\n# Skip noisy\u002Fknown-accepted checks\nsudo kube-bench run --targets node --skip 4.2.6\n```\n\n### 6. Produce machine-readable output\n\nEmit JSON or JUnit for ingestion into pipelines, SIEM, or dashboards, and write to a file:\n\n```bash\n# JSON to a file\nsudo kube-bench run --targets master,node --json --outputfile kube-bench-report.json\n\n# JUnit (for CI test reporting)\nsudo kube-bench --junit --outputfile kube-bench-junit.xml\n\n# AWS Security Finding Format (for Security Hub)\nsudo kube-bench run --targets node --asff\n```\n\n### 7. Triage and remediate FAIL\u002FWARN findings\n\nEach failing check prints a remediation. Apply the CIS-recommended fix on the node\u002Fmanifest, for example tightening API server flags in the static pod manifest:\n\n```bash\n# Example remediation for a common control-plane FAIL:\n# CIS 1.2.x — ensure anonymous-auth is disabled on the API server.\n# Edit the static pod manifest and set the flag:\nsudo vi \u002Fetc\u002Fkubernetes\u002Fmanifests\u002Fkube-apiserver.yaml\n#   - --anonymous-auth=false\n# The kubelet restarts the static pod automatically.\n\n# Example node remediation — kubelet config file permissions (CIS 4.1.x):\nsudo chmod 600 \u002Fetc\u002Fkubernetes\u002Fkubelet\u002Fkubelet-config.json\nsudo chown root:root \u002Fetc\u002Fkubernetes\u002Fkubelet\u002Fkubelet-config.json\n```\n\n### 8. Re-validate after remediation\n\nRe-run the relevant target and confirm the previously failing checks now PASS, then track the score over time:\n\n```bash\nsudo kube-bench run --targets master --check 1.2.1 --json --outputfile recheck.json\n\n# Optional: persist results to PostgreSQL for trend tracking\nsudo kube-bench run --targets master,node --pgsql\n```\n\n## Tools and Resources\n\n| Tool \u002F Resource | Purpose | Link |\n|------------------|---------|------|\n| kube-bench | CIS Kubernetes Benchmark checker | https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench |\n| kube-bench docs | Running \u002F platforms \u002F flags | https:\u002F\u002Faquasecurity.github.io\u002Fkube-bench\u002F |\n| CIS Kubernetes Benchmark | Source hardening standard | https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fkubernetes |\n| Trivy Operator | Continuous in-cluster compliance + vuln scanning | https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy-operator |\n| kube-hunter | Complementary penetration-testing tool | https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-hunter |\n\n## Validation Criteria\n\n- [ ] kube-bench installed (`kube-bench version`) or running as a Job.\n- [ ] Scan run against the correct benchmark for the cluster's Kubernetes version.\n- [ ] master, node, etcd, and policies targets each scanned.\n- [ ] JSON\u002FJUnit output produced for pipeline\u002Fdashboard ingestion.\n- [ ] FAIL and WARN findings triaged and prioritized.\n- [ ] CIS remediation applied to control-plane manifests and node configs.\n- [ ] Re-run confirms previously failing checks now PASS.\n- [ ] Results tracked over time (file archive or PostgreSQL).\n","# Benchmarking Kubernetes with kube-bench\n\n## Overview\n\nkube-bench (by Aqua Security) is an open-source tool that checks whether a Kubernetes cluster is deployed securely by running the checks documented in the **CIS Kubernetes Benchmark**. It inspects the control-plane components (API server, controller manager, scheduler, etcd), the kubelet and worker-node configuration, and cluster-wide policy settings, then reports each check as PASS, FAIL, WARN, or INFO with a remediation recommendation drawn directly from the CIS guidance. Tests are configuration-driven YAML files, so kube-bench tracks new Kubernetes versions and benchmark revisions and supports managed distributions (EKS, GKE, AKS, ACK, OpenShift, RKE, k3s).\n\nHardening a cluster against the CIS Benchmark directly reduces the attack surface for **T1610 (Deploy Container)**, where an adversary deploys a container to execute code or evade defenses — for example by abusing privileged containers, host namespaces, anonymous API access, or insecure kubelet settings that an unhardened cluster leaves exposed.\n\nkube-bench can run as a standalone binary on a node, inside a container, or — most commonly — as a Kubernetes Job whose pod has the host filesystem mounted so it can read the relevant config files. Output is available as human-readable text, JSON, JUnit, or AWS Security Finding Format (ASFF) and can be pushed to a PostgreSQL database for trend tracking.\n\n## When to Use\n\n- When establishing a security baseline for a new Kubernetes cluster against the CIS Kubernetes Benchmark.\n- When performing periodic compliance audits of control-plane and node hardening.\n- When validating remediation after applying hardening changes (re-run to confirm checks now PASS).\n- When integrating cluster compliance scanning into CI\u002FCD or a continuous monitoring pipeline.\n- When preparing evidence for SOC 2, PCI DSS, or internal hardening compliance.\n\n## Prerequisites\n\n- Access to the cluster: either SSH access to a control-plane\u002Fworker node (binary mode) or `kubectl` with permission to create Jobs (in-cluster mode).\n- Knowledge of the cluster's Kubernetes version (kube-bench auto-detects, or specify with `--version` \u002F `--benchmark`).\n- Install kube-bench (Aqua Security official methods):\n\n```bash\n# Binary release (Linux)\nKB_VERSION=0.10.7\ncurl -L -o kube-bench.tgz \\\n  \"https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench\u002Freleases\u002Fdownload\u002Fv${KB_VERSION}\u002Fkube-bench_${KB_VERSION}_linux_amd64.tar.gz\"\ntar -xzf kube-bench.tgz\nsudo mv kube-bench \u002Fusr\u002Flocal\u002Fbin\u002F\nsudo cp -R cfg \u002Fetc\u002Fkube-bench\u002Fcfg\n\n# Via Go install\ngo install github.com\u002Faquasecurity\u002Fkube-bench@latest\n\n# Run as a one-off container directly on a node (mounts host config)\ndocker run --rm --pid=host \\\n  -v \u002Fetc:\u002Fetc:ro -v \u002Fvar:\u002Fvar:ro \\\n  -t docker.io\u002Faquasec\u002Fkube-bench:latest run --targets node\n\n# Verify\nkube-bench version\n```\n\n## Objectives\n\n- Run kube-bench against the appropriate benchmark for the cluster's Kubernetes version.\n- Scan control-plane (master), node, etcd, control-plane policies, and managed-service targets.\n- Produce machine-readable JSON\u002FJUnit output for pipelines and dashboards.\n- Triage FAIL and WARN results and apply CIS remediation guidance.\n- Re-run to validate that remediations now PASS.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1610 | Deploy Container | Execution \u002F Defense Evasion | CIS Benchmark hardening enforced by kube-bench restricts privileged\u002Fhost-namespace deployments, anonymous API access, and insecure kubelet settings that adversaries abuse when deploying malicious containers. |\n\n## Workflow\n\n### 1. Run the default scan (auto-detect)\n\nRun all applicable targets, letting kube-bench detect the Kubernetes version and benchmark:\n\n```bash\nsudo kube-bench\n```\n\n### 2. Run as a Kubernetes Job (in-cluster)\n\nApply the provided Job manifest from the kube-bench repo and read the results from the pod logs:\n\n```bash\n# General-purpose job\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Fkube-bench\u002Fmain\u002Fjob.yaml\n\n# Wait, then retrieve results\nkubectl get pods -l app=kube-bench\nkubectl logs -l app=kube-bench\n\n# Platform-specific jobs are available, e.g. EKS:\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Fkube-bench\u002Fmain\u002Fjob-eks.yaml\n```\n\n### 3. Target specific components\n\nUse `run --targets` to scope the scan to particular component groups:\n\n```bash\n# Control-plane (API server, scheduler, controller manager)\nsudo kube-bench run --targets master\n\n# Worker node (kubelet, proxy)\nsudo kube-bench run --targets node\n\n# etcd datastore\nsudo kube-bench run --targets etcd\n\n# Cluster-wide policies (RBAC, pod security, network policy)\nsudo kube-bench run --targets policies\n\n# Combine multiple targets\nsudo kube-bench run --targets master,node,etcd,policies\n```\n\n### 4. Pin a specific benchmark or Kubernetes version\n\nWhen auto-detection is wrong or you must audit against a specific revision, pin the benchmark explicitly:\n\n```bash\n# Pin to a specific CIS benchmark revision\nsudo kube-bench run --benchmark cis-1.8\n\n# Or map by Kubernetes version\nsudo kube-bench --version 1.27\n\n# Managed\u002Fdistribution-specific benchmarks\nsudo kube-bench run --benchmark eks-1.5.0\nsudo kube-bench run --benchmark gke-1.6.0\nsudo kube-bench run --benchmark rke2-cis-1.7\n```\n\n### 5. Run or skip individual checks\n\nFocus on or exclude specific check IDs during remediation cycles:\n\n```bash\n# Run only specific checks\nsudo kube-bench run --targets master --check 1.2.1,1.2.2\n\n# Skip noisy\u002Fknown-accepted checks\nsudo kube-bench run --targets node --skip 4.2.6\n```\n\n### 6. Produce machine-readable output\n\nEmit JSON or JUnit for ingestion into pipelines, SIEM, or dashboards, and write to a file:\n\n```bash\n# JSON to a file\nsudo kube-bench run --targets master,node --json --outputfile kube-bench-report.json\n\n# JUnit (for CI test reporting)\nsudo kube-bench --junit --outputfile kube-bench-junit.xml\n\n# AWS Security Finding Format (for Security Hub)\nsudo kube-bench run --targets node --asff\n```\n\n### 7. Triage and remediate FAIL\u002FWARN findings\n\nEach failing check prints a remediation. Apply the CIS-recommended fix on the node\u002Fmanifest, for example tightening API server flags in the static pod manifest:\n\n```bash\n# Example remediation for a common control-plane FAIL:\n# CIS 1.2.x — ensure anonymous-auth is disabled on the API server.\n# Edit the static pod manifest and set the flag:\nsudo vi \u002Fetc\u002Fkubernetes\u002Fmanifests\u002Fkube-apiserver.yaml\n#   - --anonymous-auth=false\n# The kubelet restarts the static pod automatically.\n\n# Example node remediation — kubelet config file permissions (CIS 4.1.x):\nsudo chmod 600 \u002Fetc\u002Fkubernetes\u002Fkubelet\u002Fkubelet-config.json\nsudo chown root:root \u002Fetc\u002Fkubernetes\u002Fkubelet\u002Fkubelet-config.json\n```\n\n### 8. Re-validate after remediation\n\nRe-run the relevant target and confirm the previously failing checks now PASS, then track the score over time:\n\n```bash\nsudo kube-bench run --targets master --check 1.2.1 --json --outputfile recheck.json\n\n# Optional: persist results to PostgreSQL for trend tracking\nsudo kube-bench run --targets master,node --pgsql\n```\n\n## Tools and Resources\n\n| Tool \u002F Resource | Purpose | Link |\n|------------------|---------|------|\n| kube-bench | CIS Kubernetes Benchmark checker | https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench |\n| kube-bench docs | Running \u002F platforms \u002F flags | https:\u002F\u002Faquasecurity.github.io\u002Fkube-bench\u002F |\n| CIS Kubernetes Benchmark | Source hardening standard | https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fkubernetes |\n| Trivy Operator | Continuous in-cluster compliance + vuln scanning | https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy-operator |\n| kube-hunter | Complementary penetration-testing tool | https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-hunter |\n\n## Validation Criteria\n\n- [ ] kube-bench installed (`kube-bench version`) or running as a Job.\n- [ ] Scan run against the correct benchmark for the cluster's Kubernetes version.\n- [ ] master, node, etcd, and policies targets each scanned.\n- [ ] JSON\u002FJUnit output produced for pipeline\u002Fdashboard ingestion.\n- [ ] FAIL and WARN findings triaged and prioritized.\n- [ ] CIS remediation applied to control-plane manifests and node configs.\n- [ ] Re-run confirms previously failing checks now PASS.\n- [ ] Results tracked over time (file archive or PostgreSQL).\n",{"name":5,"tags":52,"author":53,"domain":46,"license":15,"version":54,"nist_csf":55,"subdomain":36,"description":7,"mitre_attack":57},[29,34,33,36,32,37,31],"mahipal","1.0",[56],"PR.PS-01",[58],"T1610","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbenchmarking-kubernetes-with-kube-bench",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill benchmarking-kubernetes-with-kube-bench",{"tool":75,"command":76},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill benchmarking-kubernetes-with-kube-bench",{"tool":78,"command":79},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill benchmarking-kubernetes-with-kube-bench","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbenchmarking-kubernetes-with-kube-bench\u002FSKILL.md",true,[83,88,94,98],{"path":84,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbenchmarking-kubernetes-with-kube-bench\u002FLICENSE",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fapi-reference.md","REFERENCE","参考文档",2969,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbenchmarking-kubernetes-with-kube-bench\u002Freferences\u002Fapi-reference.md",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fstandards.md",1650,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbenchmarking-kubernetes-with-kube-bench\u002Freferences\u002Fstandards.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",5717,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbenchmarking-kubernetes-with-kube-bench\u002Fscripts\u002Fagent.py",[105,130,154,181,207,234],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":112,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[111],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,116,117,46,118,119,45,120,121,38,122,123,124,125,126,127,128,129],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[136],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[138,126,139,140,117,141,46,45,142,143,144,145,146,147,148,149,150,151,152,153],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,165,166,167,168,46,169,170,142,37,171,172,173,174,175,176,177,178,179,180],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[187],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[189,190,191,46,192,193,194,195,196,197,198,199,200,201,202,203,145,204,205,206],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,46,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[240],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[117,242,46,243,244,245,246,247,248,249,250,176,251,177,252,253,254,255,256,257],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]