Kubescape k8s

Skill mguttmann/code-audit-suite/skills/kubescape-k8s

This skill should be used when the user asks to "run Kubescape", "scan Kubernetes manifests", "Kubernetes prüfen", "K8s security", "Helm chart security", "cluster posture", "NSA/CIS Kubernetes compliance", or wants to check Kubernetes/Helm/Kustomize files for misconfigurations and compliance. Runs Kubescape in Docker, processed directly in Claude Code. Only relevant for projects with Kubernetes manifests.From its SKILL.md

Install

npx -y skills add mguttmann/code-audit-suite --skill kubescape-k8s

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.2 KB, as published. Nobody here has run it

Kubescape K8s

Purpose

Kubernetes-specific posture and compliance analysis: scores manifests, Helm charts and Kustomize against frameworks (NSA-CISA, CIS, MITRE ATT&CK, SOC2, PCI), and analyzes RBAC and privilege configuration.

Relation to Trivy (no needless overlap): Trivy already does basic K8s/IaC misconfiguration. Kubescape adds more on the K8s axis — framework-based compliance scoring and RBAC/cluster posture that Trivy does not provide. Use this skill only when the project actually contains Kubernetes resources; otherwise Trivy's misconfig scanner is enough.

Core Workflow (drive to zero)

Scan the directory containing manifests/charts:

~/.claude/skills/kubescape-k8s/scripts/scan.sh [TARGET_DIR]

Fix each failed control in the YAML: drop privileged/root, set readOnlyRootFilesystem, resource limits, securityContext, network policies, least-privilege RBAC, pinned image digests.
Re-run until controls pass.

Enforcing a gate

The hard gate is the severity threshold — fail if any failed control is at/above a severity (this is what the audit suite uses by default, high):

KUBESCAPE_SEVERITY=high ~/.claude/skills/kubescape-k8s/scripts/scan.sh [DIR]

Use medium to be stricter. This is the only reliable gate: the compliance-percentage flag (--compliance-threshold) does not fail the scan with the pinned CLI image (a manifest at 66% compliance still exits 0 even at threshold 100), so it was removed rather than expose a gate that does not gate.

The gate works by exit code: a failed control at/above the threshold makes kubescape exit 1, which the wrapper maps to RESULT: FAIL. kubescape logs that verdict as a level:fatal line ("... exceeds severity threshold ..."); the wrapper does not mistake that for an operational error — only a non-gate fatal (e.g. "no resources found to scan", a Docker/parse error) maps to RESULT: ERROR (exit 125).

Notes

The container runs --rm with no persistent cache volume, so Kubescape re-downloads its frameworks on each run (a few seconds). The pinned CLI image runs as user nonroot, so mount a cache volume to /home/nonroot/.kubescape (not /home/ks, which does not exist in this image) if you want to persist them.
JSON/SARIF output for parsing: KUBESCAPE_FORMAT=json scan.sh [DIR].
Live-cluster scanning is possible but out of scope here — this skill targets manifests in the repo (the coding/refactoring workflow).

Resources

scripts/scan.sh — runs kubescape scan against a manifest directory with an optional severity gate. Exit: 0 = pass, 1 = failed controls (FINDINGS), 125 = operational error (no resources / Docker / parse). Env: KUBESCAPE_FORMAT, KUBESCAPE_SEVERITY (the hard gate), KUBESCAPE_IMAGE.