skills.rest
blamejs
blamejsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

container-runtime-security

Audit Kubernetes Pod Security Standards and generate prioritized remediation plans.

Updated May 11, 2026
Search Tags:#admission control#cis benchmark#kubernetes security#runtime detection#container hardening#compliance gaps#ai workload security
One-click install
npx skills add https://github.com/blamejs/exceptd-skills --skill container-runtime-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: container-runtime-security
Source: https://github.com/blamejs/exceptd-skills/tree/main/skills/container-runtime-security
Command: npx skills add https://github.com/blamejs/exceptd-skills --skill container-runtime-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Existing security and compliance frameworks (including NIST 800-53, ISO 27001, and the CIS Kubernetes Benchmark) were designed for pre-2024 network-centric and early-cloud environments, with no coverage for mid-2026 threats like AI inference workload risks, kernel LPE-driven container escape, or MCP/agent tool trust boundaries, leaving teams unable to secure modern Kubernetes environments or meet evolving global regulatory requirements.

Core Features & Use Cases

  • Framework Gap Mapping: Explicitly flags where 15+ global security and compliance frameworks fail to cover mid-2026 container and Kubernetes threat patterns, with per-control gap explanations.
  • 6-Layer Defense-in-Depth Procedure: Step-by-step guidance for implementing image signing, admission control, Pod Security Standards, network policy, eBPF runtime detection, and control-plane hardening.
  • AI Inference Workload Hardening: Dedicated guidance for securing KServe, vLLM, Triton Inference Server, and other AI workloads running on Kubernetes, including model serialization restrictions and GPU access controls.
  • Exploit & TTP Reference: Includes exploit availability matrices, ATT&CK/ATLAS TTP mappings, and CWE cross-walks for common container/K8s attack vectors.
  • Use Case: A financial services team running LLM inference on a self-managed Kubernetes cluster can use this skill to identify that NSA/CISA Kubernetes Hardening Guide v1.2 has no AI workload guidance, and implement the exact Kyverno and Sigstore policy steps to harden their inference pods against container escape and model exfiltration.

Quick Start

Use the container-runtime-security skill to audit your Kubernetes cluster's Pod Security Standards enforcement across all namespaces and generate a prioritized remediation plan for any non-compliant workloads.

Frequently Asked Questions about container-runtime-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden Kubernetes clusters for AI inference workload risks?▼

Harden AI inference workloads on Kubernetes by restricting model serialization and enforcing GPU access controls for platforms like KServe and vLLM. This skill provides dedicated steps to mitigate container escape and model exfiltration threats specific to AI inference pods.

What compliance frameworks cover Kubernetes container escape threats?▼

Most compliance frameworks lack coverage for kernel LPE-driven container escape. This skill maps control gaps across 15+ global frameworks, explicitly flagging where standards like NIST 800-53 and ISO 27001 fail to address mid-2026 Kubernetes threat patterns.

How do I enforce admission control and Pod Security Standards across namespaces?▼

Enforce admission control and Pod Security Standards by implementing image signing and Kyverno policies. This skill provides step-by-step guidance for a 6-layer defense-in-depth procedure covering admission policy enforcement across all cluster namespaces.

Does the CIS Kubernetes Benchmark include eBPF runtime detection guidance?▼

The CIS Kubernetes Benchmark lacks specific eBPF runtime detection deployment guidance. This skill satisfies CIS Benchmark alignment while adding explicit eBPF runtime detection steps to fill mid-2026 container security gaps not covered by existing standards.

How do I map ATT&CK and ATLAS TTPs for Kubernetes attack vectors?▼

Map Kubernetes attack vectors by referencing exploit availability matrices and ATT&CK/ATLAS TTP mappings. This skill includes CWE cross-walks for common container attack vectors, providing detailed threat intelligence for incident response and hardening assessments.

What is the best way to audit Kubernetes Pod Security Standards for compliance gaps?▼

Audit Pod Security Standards compliance by evaluating namespace enforcement and generating a prioritized remediation plan. This skill identifies non-compliant workloads and maps control gaps against multiple global security frameworks to guide hardening efforts.

Related Skills

Explore More Legal & Compliance Skills→
AraflyArafly

kubernetes-cluster-onboarding

Map an unfamiliar Kubernetes cluster before making changes.

Community
Advanced
proffesor-for-testingproffesor-for-testing
436

compliance-testing

Map GDPR, HIPAA, PCI-DSS, SOC 2, and CCPA regulations to testable controls.

Community
Advanced
TheBushidoCollectiveTheBushidoCollective
187

kubernetes-security

Enforce Kubernetes security hardening for deployments with RBAC, pod security, and network policies.

Official
Advanced
NickCrewNickCrew
29

kubernetes-security-policies

Enforce Kubernetes security policies across clusters and namespaces.

Community
Advanced