k8s-cilium — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited k8s-cilium (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Manage eBPF-based networking using kubectl-mcp-server's Cilium tools (8 tools).
Use this skill when:
| Priority | Rule | Impact | Tools |
|---|---|---|---|
| 1 | Detect Cilium installation first | CRITICAL | cilium_detect_tool |
| 2 | Check agent status for health | HIGH | cilium_status_tool |
| 3 | Use Hubble for flow debugging | HIGH | hubble_flows_query_tool |
| 4 | Start with default deny | MEDIUM | CiliumNetworkPolicy |
| Task | Tool | Example |
|---|---|---|
| Detect Cilium | cilium_detect_tool | cilium_detect_tool() |
| Agent status | cilium_status_tool | cilium_status_tool() |
| List policies | cilium_policies_list_tool | cilium_policies_list_tool(namespace) |
| Query flows | hubble_flows_query_tool | hubble_flows_query_tool(namespace) |
cilium_detect_tool()cilium_status_tool()cilium_policies_list_tool(namespace="default")cilium_policy_get_tool(name="allow-web", namespace="default")kubectl_apply(manifest="""
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-web
namespace: default
spec:
endpointSelector:
matchLabels:
app: web
ingress:
- fromEndpoints:
- matchLabels:
app: frontend
toPorts:
- ports:
- port: "80"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
app: database
toPorts:
- ports:
- port: "5432"
protocol: TCP
""")cilium_endpoints_list_tool(namespace="default")cilium_identities_list_tool()cilium_nodes_list_tool()hubble_flows_query_tool(
namespace="default",
pod="my-pod",
last="5m"
)
hubble_flows_query_tool(
namespace="default",
verdict="DROPPED"
)
hubble_flows_query_tool(
namespace="default",
type="l7"
)kubectl_apply(manifest="""
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: api-policy
namespace: default
spec:
endpointSelector:
matchLabels:
app: api
ingress:
- fromEndpoints:
- matchLabels:
app: frontend
toPorts:
- ports:
- port: "8080"
protocol: TCP
rules:
http:
- method: GET
path: "/api/v1/.*"
- method: POST
path: "/api/v1/users"
""")kubectl_apply(manifest="""
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-cross-cluster
spec:
endpointSelector:
matchLabels:
app: shared-service
ingress:
- fromEntities:
- cluster
- remote-node
""")cilium_status_tool()
cilium_endpoints_list_tool(namespace)
cilium_policies_list_tool(namespace)
hubble_flows_query_tool(namespace, pod, verdict="DROPPED")cilium_policy_get_tool(name, namespace)
cilium_endpoints_list_tool(namespace)
hubble_flows_query_tool(namespace)cilium_status_tool()
cilium_nodes_list_tool()
hubble_flows_query_tool(namespace, type="l7") cilium install~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.