How do I install the Cis Gke Autopilot V100 4.1.2 skill?

Run npx skillmds@latest add cyberstrikeus/cis-gke-autopilot-v100-4-1-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Gke Autopilot V100 4.1.2 skill do?

Minimize access to secrets (Automated) It is listed under DevOps & Infra on SkillMD.

Is Cis Gke Autopilot V100 4.1.2 safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Gke Autopilot V100 4.1.2?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Gke Autopilot V100 4.1.2 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Gke Autopilot V100 4.1.2?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Gke Autopilot V100 4.1.2 by cyberstrikeus

Name: Cis Gke Autopilot V100 4.1.2
Author: cyberstrikeus

File contents

4.1.2 Minimize access to secrets (Automated)

Profile Applicability

Level 1

Description

The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.

Rationale

Inappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets.

Impact

Care should be taken not to remove access to secrets to system components which require this for their operation.

Audit

Review the users who have get, list or watch access to secrets objects in the Kubernetes API.

Remediation

Where possible, remove get, list and watch access to secret objects in the cluster.

Default Value

CLUSTERROLEBINDING	TYPE	SA-NAMESPACE	SUBJECT
cluster-admin	Group		system:masters
system:controller:clusterrole-aggregation-controller	ServiceAccount	kube-system	clusterrole-aggregation-controller
system:controller:expand-controller	ServiceAccount	kube-system	expand-controller
system:controller:generic-garbage-collector	ServiceAccount	kube-system	generic-garbage-collector
system:controller:namespace-controller	ServiceAccount	kube-system	namespace-controller
system:controller:persistent-volume-binder	ServiceAccount	kube-system	persistent-volume-binder
system:kube-controller-manager	User		system:kube-controller-manager

References

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	4.1 Establish and Maintain a Secure Configuration Process	*	*	*
v7	5.2 Maintain Secure Images		*	*

---name: cis-gke-autopilot-v100-4-1-2description: Minimize access to secrets (Automated)---# 4.1.2 Minimize access to secrets (Automated)## Profile Applicability- Level 1## DescriptionThe Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.## RationaleInappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets.## ImpactCare should be taken not to remove access to secrets to system components which require this for their operation.## AuditReview the users who have `get`, `list` or `watch` access to `secrets` objects in the Kubernetes API.## RemediationWhere possible, remove `get`, `list` and `watch` access to `secret` objects in the cluster.## Default Value| CLUSTERROLEBINDING | TYPE | SA-NAMESPACE | SUBJECT || ---------------------------------------------------- | -------------- | ------------ | ---------------------------------- || cluster-admin | Group | | system:masters || system:controller:clusterrole-aggregation-controller | ServiceAccount | kube-system | clusterrole-aggregation-controller || system:controller:expand-controller | ServiceAccount | kube-system | expand-controller || system:controller:generic-garbage-collector | ServiceAccount | kube-system | generic-garbage-collector || system:controller:namespace-controller | ServiceAccount | kube-system | namespace-controller || system:controller:persistent-volume-binder | ServiceAccount | kube-system | persistent-volume-binder || system:kube-controller-manager | User | | system:kube-controller-manager |## References1. https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | --------------------------------------------------------- | ---- | ---- | ---- || v8 | 4.1 Establish and Maintain a Secure Configuration Process | \* | \* | \* || v7 | 5.2 Maintain Secure Images | | \* | \* |

Frequently asked questions

Cis Gke Autopilot V100 4.1.2