kubernetes pod security standards linter

Lint Pod/Deployment/CronJob manifests against Kubernetes Pod Security Standards Baseline and Restricted, with SARIF for CI.

Lint Kubernetes manifests (YAML or kubectl JSON; Pod, Deployment, StatefulSet, DaemonSet, ReplicaSet, Job, CronJob) offline against the official Pod Security Standards Baseline and Restricted profiles. Flags privileged containers, host namespaces, hostPath, hostPort, capabilities, seccomp, AppArmor, SELinux, sysctls, root users and privilege escalation, with exact field paths, fixes, a Markdown report and SARIF for CI, plus namespace pod-security label checks. Use when someone asks "will this pass restricted?", "harden my pod spec" or "prepare to enforce Pod Security Admission".

What it does

• Runs entirely offline in standard-library Python (no network, no credentials, writes only inside the working folder).
• Ships with examples, unit tests (run on Python 3.8 / 3.9 / 3.13) and a references/sources.md citing the official specs used.
• Exit codes: 0 = clean / aligned, 1 = findings, 2 = bad input — ready for CI and agent loops.

Who it's for

Security-minded developers, MSPs, small-business IT, compliance leads and IR analysts who want a repeatable offline check their agent can run.

Not legal advice / limits

See the skill's references/sources.md and Known Limitations below. Compliance-flavored output is a draft for counsel, not a certification.