# Webhook Safety Regressions

> Flag webhook safety regressions — loosened failurePolicy, shortened timeoutSeconds, TLS bypass paths, non-idempotent mutating webhooks.

- Skill: `kubernetes-sigs-kueue/webhook-safety-regressions` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kubernetes-sigs-kueue/webhook-safety-regressions`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kubernetes-sigs-kueue/webhook-safety-regressions/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: kubernetes-sigs (https://skillmd.com/u/kubernetes-sigs-kueue)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/kubernetes-sigs-kueue/webhook-safety-regressions

---


# Skill: Webhook Safety Regressions

- Validating/mutating webhook changes that loosen `failurePolicy` to `Ignore`,
  shorten `timeoutSeconds` below the existing default without justification, or add a
  path that bypasses TLS verification.
- Non-idempotent mutating webhooks — both a correctness and a security risk under
  admission retry storms.