How do I install the Cis Gke V180 4.1.2 skill?

Run npx skillmds@latest add cyberstrikeus/cis-gke-v180-4-1-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Gke V180 4.1.2 skill do?

Minimize access to secrets (Automated) It is listed under DevOps & Infra on SkillMD.

Is Cis Gke V180 4.1.2 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Gke V180 4.1.2?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Gke V180 4.1.2 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Gke V180 4.1.2?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Gke V180 4.1.2 by cyberstrikeus

Name: Cis Gke V180 4.1.2
Author: cyberstrikeus

File contents

4.1.2 Minimize access to secrets (Automated)

Profile Applicability

Level 1

Description

The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.

Rationale

Inappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets.

Impact

Care should be taken not to remove access to secrets to system components which require this for their operation.

Audit

Review the users who have get, list or watch access to secrets objects in the Kubernetes API.

Remediation

Where possible, remove get, list and watch access to secret objects in the cluster.

Default Value

CLUSTERROLEBINDING	SUBJECT
TYPE	SA-NAMESPACE
cluster-admin	system:masters
Group
system:controller:clusterrole-aggregation-controller	clusterrole-aggregation-controller
ServiceAccount	kube-system
system:controller:expand-controller	expand-controller
ServiceAccount	kube-system
system:controller:generic-garbage-collector	generic-garbage-collector
ServiceAccount	kube-system
system:controller:namespace-controller	namespace-controller
ServiceAccount	kube-system
system:controller:persistent-volume-binder	persistent-volume-binder
ServiceAccount	kube-system
system:kube-controller-manager	system:kube-controller-manager
User

References

None specified.

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	4.1 Establish and Maintain a Secure Configuration Process	*	*	*
v7	5.2 Maintain Secure Images		*	*

---name: cis-gke-v180-4-1-2description: Minimize access to secrets (Automated)---# 4.1.2 Minimize access to secrets (Automated)## Profile Applicability- Level 1## DescriptionThe Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.## RationaleInappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets.## ImpactCare should be taken not to remove access to secrets to system components which require this for their operation.## AuditReview the users who have `get`, `list` or `watch` access to `secrets` objects in the Kubernetes API.## RemediationWhere possible, remove `get`, `list` and `watch` access to `secret` objects in the cluster.## Default Value| CLUSTERROLEBINDING | SUBJECT || ---------------------------------------------------- | ---------------------------------- || TYPE | SA-NAMESPACE || cluster-admin | system:masters || Group | || system:controller:clusterrole-aggregation-controller | clusterrole-aggregation-controller || ServiceAccount | kube-system || system:controller:expand-controller | expand-controller || ServiceAccount | kube-system || system:controller:generic-garbage-collector | generic-garbage-collector || ServiceAccount | kube-system || system:controller:namespace-controller | namespace-controller || ServiceAccount | kube-system || system:controller:persistent-volume-binder | persistent-volume-binder || ServiceAccount | kube-system || system:kube-controller-manager | system:kube-controller-manager || User | |## ReferencesNone specified.## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | --------------------------------------------------------- | ---- | ---- | ---- || v8 | 4.1 Establish and Maintain a Secure Configuration Process | \* | \* | \* || v7 | 5.2 Maintain Secure Images | | \* | \* |

Frequently asked questions

Cis Gke V180 4.1.2