flux-operator-cli
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a wide array of commands for interacting with Kubernetes clusters via the
flux-operatorCLI, including bootstrapping (install), removing resources (uninstall), and managing reconciliation cycles (reconcile,suspend,resume). - [CREDENTIALS_UNSAFE]: Several commands facilitate the creation of Kubernetes secrets and cluster bootstrapping that involve sensitive data. This includes flags for passwords (
--password,--password-stdin), GitHub tokens (--instance-sync-creds), and references to private key files (--private-key-file,--age-key-file,--gpg-key-file). These are standard operations for an infrastructure management tool. - [EXTERNAL_DOWNLOADS]: The documentation includes commands that fetch components from external sources, specifically OCI registries. The
installcommand downloads operator manifests fromghcr.io/controlplaneio-fluxcd/flux-operator-manifests, and theskills installcommand retrieves AI agent skills from user-specified OCI repositories. - [DATA_EXFILTRATION]: The skill describes functionality for exporting cluster resources and reports (
export resource,export report) and comparing local YAML files with remote content from URLs (GitHub, GitLab, OCI) using thediff yamlcommand. While these are intended features for auditing and migration, they involve moving data between the cluster, local environment, and remote services.
Audit Metadata