k8s-certs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited k8s-certs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Manage TLS certificates using kubectl-mcp-server's cert-manager tools.
Use this skill when:
| Priority | Rule | Impact | Tools |
|---|---|---|---|
| 1 | Detect cert-manager first | CRITICAL | certmanager_detect_tool |
| 2 | Use staging issuer for testing | HIGH | Test with letsencrypt-staging |
| 3 | Check issuer before cert | HIGH | certmanager_clusterissuers_list_tool |
| 4 | Monitor certificate expiry | MEDIUM | certmanager_certificate_get_tool |
| Task | Tool | Example |
|---|---|---|
| Detect cert-manager | certmanager_detect_tool | certmanager_detect_tool() |
| List certificates | certmanager_certificates_list_tool | certmanager_certificates_list_tool(namespace) |
| Get certificate | certmanager_certificate_get_tool | certmanager_certificate_get_tool(name, namespace) |
| List issuers | certmanager_clusterissuers_list_tool | certmanager_clusterissuers_list_tool() |
certmanager_detect_tool()certmanager_certificates_list_tool(namespace="default")certmanager_certificate_get_tool(
name="my-tls",
namespace="default"
)kubectl_apply(manifest="""
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: my-tls
namespace: default
spec:
secretName: my-tls-secret
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
dnsNames:
- app.example.com
- www.example.com
""")certmanager_issuers_list_tool(namespace="default")
certmanager_clusterissuers_list_tool()certmanager_issuer_get_tool(name="my-issuer", namespace="default")
certmanager_clusterissuer_get_tool(name="letsencrypt-prod")kubectl_apply(manifest="""
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directory
email: [email protected]
privateKeySecretRef:
name: letsencrypt-staging-key
solvers:
- http01:
ingress:
class: nginx
""")
kubectl_apply(manifest="""
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: [email protected]
privateKeySecretRef:
name: letsencrypt-prod-key
solvers:
- http01:
ingress:
class: nginx
""")kubectl_apply(manifest="""
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned
spec:
selfSigned: {}
""")certmanager_certificaterequests_list_tool(namespace="default")
certmanager_certificaterequest_get_tool(
name="my-tls-xxxxx",
namespace="default"
)certmanager_certificate_get_tool(name, namespace)
certmanager_certificaterequests_list_tool(namespace)
get_events(namespace)certmanager_clusterissuer_get_tool(name)
get_events(namespace="cert-manager")kubectl_apply(manifest="""
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
tls:
- hosts:
- app.example.com
secretName: app-tls
rules:
- host: app.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: my-service
port:
number: 80
""") kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.