aks-troubleshooting

SAFE max severity MEDIUMSkillSpector Do not install 88 registry microsoft last scanned 1 scan

Verdict safe, but 3 findings (1 medium, 2 low), mainly unauthorized tool use, data exfiltration. Most recent scan 2026-10-22.

Findings3
Critical0
High0
Medium1
Low2
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 88
Score88 / 100
Issues8
Categoriesanalysis-evasion Privilege Escalation Tool Misuse
Version2.12.0 (static)

The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Debug live Azure Kubernetes Service (AKS) incidents with a read-only, evidence-first investigation. WHEN: pod crashes or Pending, CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, DNS or ingress failure, connectivity timeout, network policy, SNAT exhaustion, node-pool scaling blocked by QuotaExceeded or InsufficientVCPUQuota, upgrade stuck, spot or zone disruption, a bare VMExtensionProvisioningError or AllocationFailed wrapper, an uncataloged capacity symptom, or 'investigate my AKS cluster'. DO NOT USE FOR: packet capture (use aks-network-capture); GPU or model-serving issues…

Package
20 files, 128 KB
SKILL.md
1547 words, 9 sections
Code
Shell (2)
License
MIT

SKILL.md covers: AKS Troubleshooting · Operating rules · Route by symptom · Scripts · AKS-specific gotchas · Log discipline · Deep diagnostics · Report · Reference

Findings

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $FQDN (line 2) flows to `curl` at line 4.

references/symptom-map.md:222

curl -k -Iv "https://$FQDN"               # TCP + TLS connectivity
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'aka.ms' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

scripts/pod-deep-dive.sh:25

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.
LOW Script contacts a destination the documentation never mentions Unauthorized Tool Usestatic

Script contacts or configures 'jqlang.github.io' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.

scripts/pod-deep-dive.sh:33

Remediation: Document the destination in SKILL.md (or the manifest description) if it is intended, or remove the undisclosed network access. Organizations can list internal hosts in llm_analysis.trusted_reference_domains.

What is in the package

FileKindSize
SKILL.mddoc12 KB
general-diagnostics.mddoc2.8 KB
load-balancer-and-ingress.mddoc7.5 KB
network-policy.mddoc1.2 KB
networking.mddoc14 KB
node-issues.mddoc15 KB
pod-failures.mddoc8.0 KB
spot-and-zone-issues.mddoc2.5 KB
upgrade-operations.mddoc4.5 KB
references/api-server-webhooks-tunnel.mddoc6.3 KB
references/auto-upgrade-evidence.mddoc4.4 KB
references/azure-mcp.mddoc2.5 KB
references/azure-network-path.mddoc7.6 KB
references/command-flows.mddoc3.3 KB
references/inspektor-gadget.mddoc8.1 KB
references/report-template.mddoc1.1 KB
references/structured-input-modes.mddoc3.8 KB
references/symptom-map.mddoc15 KB
scripts/cluster-snapshot.shscript3.8 KB
scripts/pod-deep-dive.shscript3.6 KB

External hosts referenced

learn.microsoft.com aka.ms jqlang.github.io kubernetes.io

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

AKS_SUBSCRIPTION_ID INSTANCE_ID PROVIDER_ID COREDNS_SOURCE_SUBNET_ID NODE_NIC_ID COREDNS_ROUTE_TABLE_ID COREDNS_SUBNET_NSG_ID COREDNS_NODE_NIC_ID AZURE_HTTP_USER_AGENT COREDNS_PROVIDER_ID SOURCE_SUBNET_ID VMSS_VM_ID AKS_ARTIFACTS_DIR COREDNS_INSTANCE_ID COREDNS_NODE_SUBNET_ID COREDNS_POD_SUBNET_ID DEST_PORT NODE_SUBNET_ID POD_SUBNET_ID

Package contents recorded 2026-10-22 at commit f49ac319a7d3. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills