K8s securitycontext

Skill andypitcher/ponytail-sec/skills/k8s-securitycontext

Binary Kubernetes securityContext hardening check. Use when reviewing Pods, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Helm templates, or Kubernetes manifests that define containers. Minimal output only: OK or NOT_OK: RULE, RULE.From its SKILL.md

Install

npx -y skills add andypitcher/ponytail-sec --skill k8s-securitycontext

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

8 stars8 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.6 KB, as published. Nobody here has run it

Ask once before enforcing:

Enforce k8s-securitycontext skill? (yes / no)

If no: stop.

If yes: inspect locally first. Do not web-search by default. Web-search only if Kubernetes securityContext semantics are missing or ambiguous, and prefer the official Kubernetes docs.

Contract

Return exactly one line:

OK
NOT_OK: RULE, RULE

No severity. No advisory text. No maybes. If a rule cannot be verified, it is not OK.

Rules

All rules are mandatory for every application container. Apply to init and ephemeral containers when present too.

SC_NON_ROOT — require runAsNonRoot: true and no explicit root user (runAsUser: 0 is not OK).
SC_NO_PRIV_ESC — require allowPrivilegeEscalation: false.
SC_DROP_CAPS — require capabilities.drop: ["ALL"]; adding capabilities is not OK unless the manifest proves the workload needs them.
SC_SEC_PROFILE — require seccompProfile.type: RuntimeDefault or a stricter local profile.
SC_READ_ONLY_FS — require readOnlyRootFilesystem: true.
SC_SELINUX_TYPE — when the workload targets an SELinux-enforcing node class, OpenShift, SELinux-labeled volumes, or policy says SELinux is required, require seLinuxOptions.type. Missing type is not OK.

Output examples

OK

NOT_OK: SC_NON_ROOT, SC_NO_PRIV_ESC, SC_SELINUX_TYPE