How do I install the Cis Aks V170 4.1.2 skill?

Run npx skillmds@latest add cyberstrikeus/cis-aks-v170-4-1-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Aks V170 4.1.2 skill do?

Minimize access to secrets (Automated) It is listed under DevOps & Infra on SkillMD.

Is Cis Aks V170 4.1.2 safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Aks V170 4.1.2?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Aks V170 4.1.2 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Aks V170 4.1.2?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Aks V170 4.1.2 by cyberstrikeus

Name: Cis Aks V170 4.1.2
Author: cyberstrikeus

File contents

4.1.2 Minimize access to secrets (Automated)

Profile Applicability

Level 1

Description

The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.

Rationale

Inappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets.

Impact

Care should be taken not to remove access to secrets to system components which require this for their operation.

Audit

Review the users who have get, list or watch access to secrets objects in the Kubernetes API.

Remediation

Where possible, remove get, list and watch access to secret objects in the cluster.

Default Value

By default, the following list of principals have get privileges on secret objects:

CLUSTERROLEBINDING	SUBJECT
cluster-admin (Group)	system:masters
system:controller:clusterrole-aggregation-controller (ServiceAccount kube-system)	clusterrole-aggregation-controller
system:controller:expand-controller (ServiceAccount kube-system)	expand-controller
system:controller:generic-garbage-collector (ServiceAccount kube-system)	generic-garbage-collector
system:controller:namespace-controller (ServiceAccount kube-system)	namespace-controller
system:controller:persistent-volume-binder (ServiceAccount kube-system)	persistent-volume-binder
system:kube-controller-manager (User)	system:kube-controller-manager

References

https://docs.microsoft.com/security/benchmark/azure/security-controls-v2-identity-management#im-7-eliminate-unintended-credential-exposure

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	4.1 Establish and Maintain a Secure Configuration Process	x	x	x
v7	5.2 Maintain Secure Images		x	x

---name: cis-aks-v170-4-1-2description: Minimize access to secrets (Automated)---# 4.1.2 Minimize access to secrets (Automated)## Profile Applicability- Level 1## DescriptionThe Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.## RationaleInappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets.## ImpactCare should be taken not to remove access to secrets to system components which require this for their operation.## AuditReview the users who have `get`, `list` or `watch` access to `secrets` objects in the Kubernetes API.## RemediationWhere possible, remove `get`, `list` and `watch` access to `secret` objects in the cluster.## Default ValueBy default, the following list of principals have `get` privileges on `secret` objects:| CLUSTERROLEBINDING | SUBJECT || --------------------------------------------------------------------------------- | ---------------------------------- || cluster-admin (Group) | system:masters || system:controller:clusterrole-aggregation-controller (ServiceAccount kube-system) | clusterrole-aggregation-controller || system:controller:expand-controller (ServiceAccount kube-system) | expand-controller || system:controller:generic-garbage-collector (ServiceAccount kube-system) | generic-garbage-collector || system:controller:namespace-controller (ServiceAccount kube-system) | namespace-controller || system:controller:persistent-volume-binder (ServiceAccount kube-system) | persistent-volume-binder || system:kube-controller-manager (User) | system:kube-controller-manager |## References1. [https://docs.microsoft.com/security/benchmark/azure/security-controls-v2-identity-management#im-7-eliminate-unintended-credential-exposure](https://docs.microsoft.com/security/benchmark/azure/security-controls-v2-identity-management#im-7-eliminate-unintended-credential-exposure)## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | --------------------------------------------------------- | ---- | ---- | ---- || v8 | 4.1 Establish and Maintain a Secure Configuration Process | x | x | x || v7 | 5.2 Maintain Secure Images | | x | x |

Frequently asked questions

Cis Aks V170 4.1.2