feat(rh-developer): add /incident-triage orchestration skill

[jordigilh]

Summary

• Adds a new /incident-triage orchestration skill to rh-developer that provides structured incident investigation for OpenShift using Five Whys methodology, 5 investigation guardrails, Prometheus metric analysis, and 8-dimension adversarial due diligence
• The skill follows a 6-step workflow (Gather Context → Hierarchical Investigation → Evidence Collection → Root Cause Analysis → Due Diligence → Findings) with human-in-the-loop checkpoints at every step
• Routes to specialized debug skills (/debug-pod, /debug-network) when single-resource issues are identified, acting as the top-level entry point for complex or multi-resource incidents

Design

The skill adapts Kubernaut's investigation prompt methodology into the agentic-collections SKILL.md format:

• Step 1 gathers incident context and branches between alert-based, symptom-based, and proactive (predicted) investigation modes
• Step 2 traces the Kubernetes ownership chain (Deployment → ReplicaSet → Pod → Container) with pod sampling limits
• Step 3 applies 5 investigation guardrails (exhaustive verification, contradicting evidence search, causal depth, evidence-based claims, error separation) and Prometheus metric analysis via the observability MCP
• Step 4 constructs the Five Whys causal chain and identifies the remediation target (the resource whose config change fixes the problem, not the symptom reporter)
• Step 5 runs 8-dimension adversarial due diligence (causal completeness, target accuracy, evidence sufficiency, alternative hypotheses, scope completeness, proportionality, regression awareness, confidence calibration)
• Step 6 presents structured findings with oc remediation commands and chains to specialized skills

Dependencies

• openshift MCP (required) — existing
• observability MCP (required for Step 3 Prometheus queries) — forward-declared; the skill documents this dependency and will fully function once the observability MCP is available

Files Changed

File	Change
rh-developer/skills/incident-triage/SKILL.md	New — 6-step orchestration skill
rh-developer/CLAUDE.md	Intent routing, skill chaining, observability MCP entry
rh-developer/.catalog/collection.yaml	Orchestration skill registration + decision guide
rh-developer/.catalog/collection.json	Orchestration skill registration + decision guide

Test plan

• make validate passes
• Skill frontmatter has name: incident-triage, model: inherit, color: cyan, metadata.user_invocable: "true"
• WAIT checkpoints present after every step
• Skill registered in both .catalog/collection.yaml and .catalog/collection.json as orchestration skill
• No references to debug-scc/debug-rbac skill directories (those are in a separate PR)
• Reviewer: verify skill chaining paths in CLAUDE.md are consistent

Made with Cursor

[dmartinol]

/skill-code-review

[dmartinol]

/skill-security-scan

[github-actions]

❌ Skill Security Scan

📋 rh-developer

Agent Skills Security Scan Report

Timestamp: 2026-05-07T07:24:34.023448+00:00

Summary

• Total Skills Scanned: 15
• Safe Skills: 13
• Total Findings: 40

Findings by Severity

• Critical: 1
• High: 2
• Medium: 8
• Low: 14
• Info: 15

Skill Results

---

[OK] recommend-image

• Max Severity: INFO

• Findings: 1

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/recommend-image

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[FAIL] debug-rhel

• Max Severity: CRITICAL

• Findings: 3

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/debug-rhel

  [CRITICAL] Command Injection Vulnerability in SSH Command Construction

  Severity: CRITICAL
  Category: command_injection
  Rule ID: LLM_COMMAND_INJECTION
  Location: SKILL.md

  Description: The skill constructs and executes shell commands on a remote host via SSH using unvalidated user input, specifically for the service name. A malicious actor could provide a crafted service name like 'nonexistent.service; rm -rf /' to inject and execute arbitrary commands on the target system. Since many subsequent commands in the workflow use 'sudo', this could lead to privileged command execution.

  Code Snippet:

  ssh [user]@[host] "systemctl status [service] --no-pager -l"
  

  Remediation: Implement strict input validation and sanitization for all user-provided variables used in shell commands. Use an allowlist for service names or escape shell metacharacters to prevent command injection.

  [LOW] Missing allowed-tools Declaration in Manifest

  Severity: LOW
  Category: unauthorized_tool_use
  Rule ID: LLM_UNAUTHORIZED_TOOL_USE
  Location: SKILL.md

  Description: The skill's manifest does not declare the allowed-tools field. The skill's functionality is entirely dependent on executing shell commands via the Bash tool, which should be explicitly declared. This omission reduces transparency and hinders automated security policy enforcement.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Add the allowed-tools key to the YAML frontmatter in SKILL.md and specify the tools used, for example: allowed-tools: [Bash].

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] debug-build

• Max Severity: INFO

• Findings: 1

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/debug-build

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] detect-project

• Max Severity: LOW

• Findings: 2

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/detect-project

  [LOW] Missing allowed-tools Declaration in Manifest

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill's manifest (SKILL.md) does not specify the allowed-tools field. While this field is optional, declaring it provides a defense-in-depth security control by restricting the agent to only the necessary tools, preventing unexpected or unauthorized tool usage.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Explicitly define the tools the skill requires in the SKILL.md frontmatter. Based on the instructions, this would likely include tools for reading files and interacting with specific MCP servers. For example: allowed-tools: [Read, Grep, Glob, mcp_github_get_file_contents].

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] incident-triage

• Max Severity: MEDIUM

• Findings: 3

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/incident-triage

  [MEDIUM] Indirect Prompt Injection Risk via External File References

  Severity: MEDIUM
  Category: prompt_injection
  Rule ID: LLM_PROMPT_INJECTION
  Location: SKILL.md

  Description: The skill's instructions reference documentation files using path traversal (../../docs/...). This instructs the agent to read and potentially follow instructions from files located outside the trusted skill package. If an attacker can control the content of these external files, they could inject malicious instructions, leading to indirect prompt injection and compromising the agent's behavior.

  Code Snippet:

  See [Human-in-the-Loop Requirements](../../docs/human-in-the-loop.md) for mandatory checkpoint behavior.
  

  Remediation: All referenced files required for the skill's operation should be bundled within the skill's directory. Replace relative paths that traverse upwards (e.g., ../../) with paths local to the skill package to ensure the agent only consults trusted, packaged content.

  [LOW] Missing allowed-tools Declaration

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill's manifest (SKILL.md) does not specify the allowed-tools field. While this field is optional, its absence means there are no manifest-level restrictions on the agent's tool usage for this skill. This reduces clarity and removes a potential security boundary that could prevent the skill from using unintended or overly permissive tools.

  Code Snippet:

  The YAML frontmatter in SKILL.md does not contain an `allowed-tools` key.
  

  Remediation: Add an allowed-tools key to the skill's manifest, explicitly listing all tools required for its operation (e.g., Bash, and specific tools for Kubernetes and Observability access). This improves security posture by enforcing the principle of least privilege.

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] validate-environment

• Max Severity: MEDIUM

• Findings: 3

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/validate-environment

  [MEDIUM] Privileged Command Execution Recommendation

  Severity: MEDIUM
  Category: harmful_content
  Rule ID: LLM_HARMFUL_CONTENT
  Location: SKILL.md

  Description: The skill recommends that the user execute commands with sudo to install missing software packages. This is a social engineering risk, as a user might execute the command without verifying the package's authenticity. If the skill's logic were compromised or influenced by malicious input, it could be used to trick a user into installing a malicious package, leading to system compromise.

  Code Snippet:

  # Install missing tools
  sudo dnf install skopeo

  Remediation: Avoid directly suggesting sudo commands. Instead, inform the user which package is required and direct them to official installation documentation. The user should be responsible for verifying and executing privileged commands.

  [LOW] Missing allowed-tools Declaration in Manifest

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The SKILL.md manifest does not declare the allowed-tools field. While this field is optional, its absence means there are no explicit restrictions on the tools the agent can use when executing the skill, reducing security controls and clarity. The skill's instructions clearly rely on executing Bash commands.

  Code Snippet:

  The YAML frontmatter in SKILL.md is missing the `allowed-tools` key.
  

  Remediation: Add allowed-tools: [Bash] to the YAML manifest to explicitly declare the skill's intended tool usage and allow for more robust policy enforcement.

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] debug-container

• Max Severity: LOW

• Findings: 2

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/debug-container

  [LOW] Missing allowed-tools Declaration in Manifest

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill's manifest (SKILL.md) does not specify the allowed-tools field. While this field is optional, its absence means the skill does not explicitly declare its intended tool usage, such as the podman MCP server it relies on. This reduces clarity and makes automated policy enforcement based on declared capabilities more difficult.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Explicitly declare the tools and MCP servers the skill is designed to use in the allowed-tools field of the SKILL.md frontmatter. For this skill, this should include the podman MCP.

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] debug-pipeline

• Max Severity: LOW

• Findings: 2

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/debug-pipeline

  [LOW] Missing allowed-tools Declaration in Manifest

  Severity: LOW
  Category: unauthorized_tool_use
  Rule ID: LLM_UNAUTHORIZED_TOOL_USE
  Location: SKILL.md

  Description: The skill manifest (SKILL.md frontmatter) does not specify the allowed-tools field. While this field is optional, its absence reduces clarity and prevents the agent from programmatically enforcing tool usage restrictions. The skill's instructions clearly indicate the use of Kubernetes/OpenShift tools, which should be explicitly declared.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Add an allowed-tools key to the SKILL.md frontmatter, explicitly listing the required agent tools (e.g., based on the instructions, this would likely include tools for interacting with a Kubernetes/OpenShift API).

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[FAIL] rhel-deploy

• Max Severity: HIGH

• Findings: 5

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/rhel-deploy

  [HIGH] Activation Priority Manipulation in Skill Description

  Severity: HIGH
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill's description in the YAML manifest contains manipulative language ('CRITICAL: When user types /rhel-deploy, use THIS skill immediately.') intended to abuse the agent's skill discovery and activation mechanism. This attempts to force the agent to prioritize this skill over others, a form of keyword baiting and protocol manipulation.

  Code Snippet:

  description: CRITICAL: When user types /rhel-deploy, use THIS skill immediately. This skill deploys applications to standalone RHEL/Fedora/CentOS systems...
  

  Remediation: Remove the manipulative and instructional language from the skill's description. The description should be a neutral, factual summary of the skill's capabilities, not a command to the agent.

  [MEDIUM] Potential for Command Injection via Unsanitized Inputs

  Severity: MEDIUM
  Category: command_injection
  Rule ID: LLM_COMMAND_INJECTION
  Location: SKILL.md

  Description: The skill instructs the agent to construct and execute numerous shell commands on a remote host using variables derived from user input (e.g., SSH target, application name, port numbers). The instructions lack any requirement for input sanitization, creating a risk that a malicious user could provide crafted input to alter the commands executed on the target system, leading to arbitrary command execution.

  Code Snippet:

  ssh [target] "sudo dnf install -y [packages]"
  rsync -avz --exclude node_modules --exclude .git ./ [target]:/tmp/[app-name]-build/
  

  Remediation: The skill instructions must be updated to explicitly require validation and sanitization of all user-provided inputs before they are used to construct shell commands. Implement strict validation rules for hostnames, usernames, paths, and port numbers.

  [MEDIUM] Missing Critical Template Files Leading to Unreliable Behavior

  Severity: MEDIUM
  Category: unauthorized_tool_use
  Rule ID: LLM_UNAUTHORIZED_TOOL_USE
  Location: SKILL.md

  Description: The skill's instructions depend on critical template files for creating systemd services (e.g., 'templates/systemd/systemd-native.service'), but these files are missing from the skill package. This renders the skill non-functional and could force the agent to generate these sensitive configuration files from its own knowledge, potentially resulting in insecure or incorrect system configurations.

  Code Snippet:

  Template to use: `templates/systemd/systemd-native.service`
  (Analysis notes that this file and others were not found).
  

  Remediation: All required template and documentation files must be included within the skill package. The skill should be self-contained and not rely on the agent to generate critical configuration files.

  [LOW] Missing Optional Skill Metadata

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill manifest (SKILL.md frontmatter) is missing optional but recommended metadata fields such as allowed-tools, license, and compatibility. While not a direct vulnerability, this reduces the skill's clarity and makes it harder for automated systems to enforce tool usage policies.

  Code Snippet:

  The YAML manifest does not contain the 'allowed-tools', 'license', or 'compatibility' keys.
  

  Remediation: Add the missing metadata fields to the skill's manifest to improve clarity, security policy enforcement, and maintainability. For this skill, allowed-tools should at a minimum include 'Bash'.

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] helm-deploy

• Max Severity: LOW

• Findings: 3

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/helm-deploy

  [LOW] Skill is Non-Functional Due to Missing Referenced Files

  Severity: LOW
  Category: resource_abuse
  Rule ID: LLM_RESOURCE_ABUSE
  Location: SKILL.md

  Description: The skill's instructions reference numerous essential template files (e.g., templates/helm/, templates/deployment.yaml) that are not included in the skill package. This will cause the skill to fail during execution, making it unavailable for its intended purpose and disrupting its functionality.

  Code Snippet:

  Use templates from templates/helm/ to generate:
  1. Chart.yaml
  2. values.yaml
  3. templates/deployment.yaml
  ...
  

  Remediation: Package all required template and reference files with the skill to ensure it can execute its workflow successfully and reliably.

  [LOW] Missing allowed-tools Declaration in Manifest

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill's manifest (SKILL.md) does not specify the allowed-tools field. While optional, this field is a security best practice that restricts the agent to a predefined set of tools, preventing unexpected or unauthorized tool usage. Its absence reduces the clarity of the skill's capabilities and limitations.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Add an allowed-tools key to the skill's YAML manifest, explicitly listing the tools required for its operation (e.g., Read, Write, Glob, and any required MCP tools like 'kubernetes').

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] debug-pod

• Max Severity: LOW

• Findings: 2

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/debug-pod

  [LOW] Missing Optional 'allowed-tools' Declaration

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill manifest (SKILL.md) does not specify the 'allowed-tools' field. While this field is optional, its absence reduces clarity about the skill's intended capabilities and limitations. Declaring allowed tools is a security best practice for transparency.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Add the 'allowed-tools' field to the skill's YAML manifest to explicitly declare the tools it is permitted to use. If it only uses proprietary MCP tools, this could be noted or the list could be empty.

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] s2i-build

• Max Severity: LOW

• Findings: 2

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/s2i-build

  [LOW] Missing allowed-tools Declaration in Manifest

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill's manifest (SKILL.md frontmatter) does not specify the allowed-tools field. While this field is optional, its absence means there is no explicit declaration of which agent tools the skill is intended to use. This reduces the agent's ability to enforce the principle of least privilege based on the skill's manifest.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Add an allowed-tools key to the SKILL.md frontmatter to explicitly declare the tools required for its operation. Based on its function of interacting with an OpenShift cluster via an MCP, this would likely include tools that execute shell commands.

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] debug-network

• Max Severity: LOW

• Findings: 2

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/debug-network

  [LOW] Missing 'allowed-tools' Declaration in Manifest

  Severity: LOW
  Category: unauthorized_tool_use
  Rule ID: LLM_UNAUTHORIZED_TOOL_USE
  Location: SKILL.md

  Description: The skill's manifest (SKILL.md frontmatter) does not specify the 'allowed-tools' field. While this field is optional, declaring it is a security best practice that explicitly lists the tools the agent is permitted to use. Without this declaration, the skill's intended tool usage is not programmatically defined, potentially allowing for broader tool access than necessary.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Add an 'allowed-tools' key to the skill's manifest YAML frontmatter. Based on the instructions, this should likely include the specific MCP tools used for Kubernetes/OpenShift interactions.

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] deploy

• Max Severity: LOW

• Findings: 3

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/deploy

  [LOW] Missing Referenced Template Files Causes Denial of Service

  Severity: LOW
  Category: resource_abuse
  Rule ID: LLM_RESOURCE_ABUSE
  Location: SKILL.md

  Description: The skill's instructions depend on reading from several local template files (e.g., 'templates/deployment.yaml.template', 'templates/service.yaml.template') to create Kubernetes manifests. These files are missing from the provided skill package. This will cause the skill to fail at runtime, rendering its functionality unavailable.

  Code Snippet:

  Read `templates/deployment.yaml.template` and substitute `${APP_NAME}`, `${NAMESPACE}`, `${PORT}`, `${REPLICAS}` with session state values.
  

  Remediation: Ensure all required template files are included within the skill's package directory at the paths referenced in the instructions. Verify the integrity of the skill package to prevent functional failures.

  [LOW] Optional 'allowed-tools' Field is Missing

  Severity: LOW
  Category: skill_discovery_abuse
  Rule ID: LLM_SKILL_DISCOVERY_ABUSE
  Location: SKILL.md

  Description: The skill's manifest (SKILL.md frontmatter) does not specify the 'allowed-tools' field. While this field is optional, its absence means there are no explicit restrictions on which agent tools (e.g., Read, Write, Bash, Python) the skill can use. Defining this provides a layer of defense-in-depth.

  Code Snippet:

  allowed-tools: Not specified
  

  Remediation: Add the 'allowed-tools' field to the YAML frontmatter in SKILL.md to declare the intended tools. If the skill only uses external MCPs and no standard agent tools, specify an empty list allowed-tools: [].

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

[OK] containerize-deploy

• Max Severity: MEDIUM

• Findings: 3

• Directory: /home/runner/work/agentic-collections/agentic-collections/rh-developer/skills/containerize-deploy

  [MEDIUM] Insecure Supply Chain due to Transitive Trust in Dependent Skills

  Severity: MEDIUM
  Category: supply_chain_attack
  Rule ID: LLM_SUPPLY_CHAIN_ATTACK
  Location: SKILL.md

  Description: The skill acts as an orchestrator, delegating critical operations like building and deploying applications to other skills (/s2i-build, /helm-deploy, /rhel-deploy, etc.). This creates a transitive trust relationship where a vulnerability or malicious behavior in any of these dependent skills would be executed with the user's authority, potentially compromising the deployment environment. The overall security of this skill has not been independently verified and relies entirely on the security of its dependencies.

  Code Snippet:

  The skill's workflow explicitly delegates to numerous other skills, such as: 'Delegate to `/rhel-deploy` skill', 'Delegate to `/helm-deploy` skill', and invoking debug skills like `/debug-pod`.
  

  Remediation: Each dependent skill must be independently audited for security vulnerabilities. The orchestrator skill should implement safeguards or policies to constrain the behavior of the skills it calls, such as validating their outputs or running them in a sandboxed environment.

  [MEDIUM] Potential for Malicious Code Generation via Missing Templates

  Severity: MEDIUM
  Category: unauthorized_tool_use
  Rule ID: LLM_UNAUTHORIZED_TOOL_USE
  Location: SKILL.md

  Description: The skill is designed to generate Helm charts using templates from the templates/helm/ directory. However, these template files are missing from the provided skill package. This could allow for malicious templates to be loaded from an uncontrolled location at runtime, leading to the generation and deployment of compromised Kubernetes resources.

  Code Snippet:

  If user chose "Create Helm chart":
  - Generate chart using templates from templates/helm/
  

  Remediation: All templates required by the skill should be included and validated within the skill package itself. The skill should be prevented from loading templates from external or dynamic locations at runtime.

  [INFO] Skill does not specify a license

  Severity: INFO
  Category: policy_violation
  Rule ID: MANIFEST_MISSING_LICENSE
  Location: SKILL.md

  Description: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

  Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

---

Cross-Skill Findings

• Findings: 3

  [HIGH] Potential data relay attack pattern detected

  Severity: HIGH
  Category: data_exfiltration
  Rule ID: CROSS_SKILL_DATA_RELAY
  Location: (cross-skill analysis)

  Description: Skills appear to form a data relay chain. Collectors (recommend-image, debug-rhel, debug-build, detect-project, incident-triage, validate-environment, debug-container, debug-pipeline, rhel-deploy, helm-deploy, debug-pod, s2i-build, debug-network, deploy, containerize-deploy) access sensitive data while exfiltrators (containerize-deploy) send data to external destinations. This pattern may indicate a coordinated attack.

  Remediation: Review these skills together to ensure they are not collaborating to exfiltrate sensitive data. Consider disabling one or both skills.

  [MEDIUM] Multiple skills reference the same external domain

  Severity: MEDIUM
  Category: data_exfiltration
  Rule ID: CROSS_SKILL_SHARED_URL
  Location: (cross-skill analysis)

  Description: Domain '[route-host' is referenced by 3 skills: helm-deploy, debug-network, deploy. Multiple skills pointing to the same external resource may indicate coordinated C2 or exfiltration.

  Remediation: Review why multiple skills reference this domain and ensure it is a legitimate, trusted resource.

  [MEDIUM] Multiple skills reference the same external domain

  Severity: MEDIUM
  Category: data_exfiltration
  Rule ID: CROSS_SKILL_SHARED_URL
  Location: (cross-skill analysis)

  Description: Domain '[app-name' is referenced by 2 skills: deploy, containerize-deploy. Multiple skills pointing to the same external resource may indicate coordinated C2 or exfiltration.

  Remediation: Review why multiple skills reference this domain and ensure it is a legitimate, trusted resource.

Workflow run

[dmartinol]

Pls rebase

[dmartinol]

Thanks for your contribution! /lgtm