Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-privilege-escalation-in-kubernetes-podsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-privilege-escalation-in-kubernetes-pods -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-privilege-escalation-in-kubernetes-pods -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-privilege-escalation-in-kubernetes-podsgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-privilege-escalation-in-kubernetes-podsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-privilege-escalation-in-kubernetes-pods ~/.claude/skills/detecting-privilege-escalation-in-kubernetes-pods # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-privilege-escalation-in-kubernetes-pods ~/.agents/skills/detecting-privilege-escalation-in-kubernetes-pods # Codex, Cursor, Gemini CLI, Copilot, OpenCode