runtime-security SKILL.md skillA
runtime-security from nitinjain999/platform-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add nitinjain999/platform-skills/runtime-security@git:20261017.0361a9bPins git:20261017.0361a9b in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- nitinjain999/platform-skills
- Path
skills/runtime-security/SKILL.md- Versions recorded
- 2
- Latest version
- git:20261017.0361a9b, committed Oct 17, 2026
- First version recorded
- Oct 11, 2026
- Size
- 10,007 bytes
- Repository stars
- 71
- License
- Apache-2.0
Detect and respond to in-container threats at the syscall level using Falco (eBPF-based, CNCF, open-source, no license cost). Covers Falco installation on EKS/GKE with eBPF driver, custom rule authoring, alert routing via Falcosidekick, rule debugging, and bridging Falco runtime signals to Kyverno admission enforcement. Use when asked to "detect privilege escalation in containers", "set up runtime threat detection", "write a Falco rule", "route Falco alerts to Slack", or…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
Detect and respond to threats inside running containers using Falco. --- ## Interactive Wizard (fires when no arguments are provided) When invoked with no arguments, ask before proceeding: **Q1 — Mode?** ``` What do you need? 1. install — deploy Falco on Kubernetes (EKS or GKE) with eBPF driver 2. rules — write and test a custom Falco rule 3. alerts — configure Falcosidekick to route alerts (Slack, webhook, etc.) 4. debug — diagnose why a Falco rule is not firing 5. harden — map runtime Falco alerts to Kyverno admission policies Alerts on behaviour a container never showed while learning (profile-based, no rule writing), or Kubescape already runs → /platform-skills:kubescape-operator runtime Enter 1–5 or mode name: ``` Before `install`, check for another eBPF agent: `kubectl get ds -A | grep -iE 'node-agent|tetragon'`. Kubescape's node-agent with `runtimeDetection` overlaps with Falco on the same nodes; pick one per node pool, or disable Kubescape's `runtimeDetection` and keep its posture and CVE capabilities. **Q2 — Context** (after mode selected, one at a time): - **install**: `Which cloud platform? EKS / GKE / other (specify node OS if known):` …
Read the whole file at its exact version.
How to install
mdr add nitinjain999/platform-skills/runtime-security@sha256:fdc3c74aaf98cce8The line at the top of this page pins the label git:20261017.0361a9b, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_zkgj2vr3au6eecik)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Oct 11, 2026 and Oct 17, 2026, about one every 6 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261017.0361a9b latest | 2026-10-17 | 0361a9b | 10,007 B | A | view · diff |
| git:20261011.e8166a5 | 2026-10-11 | e8166a5 | 9,536 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10007 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
nitinjain999/platform-skills · 71 stars · license Apache-2.0 · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_zkgj2vr3au6eecik GET https://markdownregistry.com/api/v1/resolve?ref=nitinjain999/platform-skills/runtime-security GET https://markdownregistry.com/api/v1/blob/fdc3c74aaf98cce87797c1e4484a656402ea3af7724847ba71b3860022c3a67b
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from nitinjain999/platform-skills
Every file in nitinjain999/platform-skills