---
name: "kubescape-kubernetes-compliance"
description: "Scan Kubernetes clusters against NSA-CISA, MITRE ATT&CK, and CIS benchmarks."
metadata:
  author: "ARMO"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run kubescape scan"
  - "check nsa-cisa compliance kubescape"
  - "audit kubernetes rbac kubescape"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Kubescape NSA-CISA Kubernetes Security Compliance

Evaluates Kubernetes cluster posture with Kubescape: scanning running clusters, evaluating RBAC configurations, detecting container vulnerabilities, and generating compliance scores.

## When to Invoke
Invoke this skill whenever you need to:
- run kubescape scan
- check nsa-cisa compliance kubescape
- audit kubernetes rbac kubescape

## Execution SOP & Rules
1. Execute kubescape scan framework nsa to run comprehensive compliance checks.
2. Review failing controls and implement recommended securityContext and RBAC fixes.
3. Integrate Kubescape CLI into CI pipelines to evaluate Kubernetes YAML manifests pre-merge.
4. Track compliance score improvements over time using Kubescape telemetry.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.