rtexit-method 0.1.0 → 0.1.1

package/packaged-assets/.agents/skills/rt-exploit-containers/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: rt-exploit-containers
+description: "Container and Kubernetes security assessment skill for authorized review of images, runtime posture, RBAC, secrets, network policy, admission controls, and cloud workload identity."
+---
+
+# rt-exploit-containers - Container and Kubernetes Assessment
+
+## Overview
+
+Container security risk spans build pipelines, images, registries, runtime privileges, Kubernetes RBAC, service accounts, secrets, workload identity, and network boundaries. This skill focuses on safe configuration validation and blast-radius analysis.
+
+## Prerequisites
+
+- In-scope clusters, namespaces, registries, and workloads.
+- Read-only kubeconfig or approved cloud role.
+- Test namespace if active validation is approved.
+- Production disruption constraints.
+- Secret handling rules.
+
+## Assessment Areas
+
+| Area | Checks |
+|---|---|
+| Images | Base image age, critical CVEs, embedded secrets, provenance. |
+| Runtime | Privileged mode, host mounts, host networking, capabilities. |
+| Kubernetes RBAC | Service account permissions, wildcard verbs/resources, cluster-admin. |
+| Secrets | Plaintext env vars, broad secret access, rotation process. |
+| Network | Namespace isolation, ingress/egress policy, metadata access. |
+| Admission | Pod Security Standards, image signing, policy enforcement. |
+| Cloud Identity | IRSA/workload identity permissions and trust boundaries. |
+
+## Workflow
+
+1. Inventory clusters, namespaces, and workloads.
+2. Review RBAC from least-privilege perspective.
+3. Review pod specs for risky runtime settings.
+4. Check secrets exposure and environment variables.
+5. Review image security and registry controls.
+6. Model whether a pod compromise can reach host, cluster admin, or cloud admin.
+7. Document control gaps and remediation sequence.
+
+## Evidence
+
+Use sanitized manifests, RBAC summaries, screenshots from cloud console, and scanner output with secret values redacted.
+
+## Remediation
+
+- Enforce restricted Pod Security Standards.
+- Remove privileged containers and host mounts.
+- Reduce service account permissions.
+- Add network policies.
+- Use secret managers and rotation.
+- Sign images and enforce trusted registries.
+- Add runtime detection for suspicious process/network behavior.
+