What problem does it solve? Security audits of managed Kubernetes clusters often produce generic hardening advice that ignores the shared-responsibility split and misses GPU-specific risks like privileged device-plugin DaemonSets and NVIDIA container toolkit CVEs. This Skill produces an evidence-backed findings table where every check is either executed with a command or explicitly assigned to the provider. ## Core Features & Use Cases - Shared-responsibility scoping: Filters out provider-owned CIS sections 1-3 (control plane, etcd) and generates written attestation questions for the provider, treating unanswered items as open findings. - Customer-side CIS section 5 checklist: Executes RBAC minimization, Pod Security Standards labels, default-deny NetworkPolicies, secrets handling, and admission control checks with concrete kubectl commands. - GPU-specific risk audit: Covers privileged NVIDIA DaemonSet containment, container toolkit CVE inventory, untrusted ML images on shared GPU nodes, hostPath mounts, and JupyterHub attack surface. - Use Case: A platform team running a multi-tenant GPU research cluster on Lambda needs a quarterly security posture review; the Skill runs the checklist, captures command output as evidence, and delivers a severity-ranked findings table with a top-5 burn-down list. ## Quick Start Use the k8s-security-baseline skill to run a CIS security audit of my managed Kubernetes cluster and produce a findings table with severity and remediation.
