devspace
Provides guidance for using DevSpace to automate Kubernetes application development, deployment, and management.
Install this skill
Security score
The devspace skill was audited on Feb 9, 2026 and we found 39 security issues across 2 threat categories, including 8 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 168 | ```yaml |
Template literal with variable interpolation in command context
| 249 | ```yaml |
Template literal with variable interpolation in command context
| 267 | - `${runtime.images.IMAGE_NAME.image}` - Full image name with tag |
Template literal with variable interpolation in command context
| 268 | - `${runtime.images.IMAGE_NAME.tag}` - Just the tag |
Template literal with variable interpolation in command context
| 269 | - `${runtime.images.IMAGE_NAME.imageName}` - Just the image name (no tag) |
Template literal with variable interpolation in command context
| 316 | - `${DEVSPACE_NAMESPACE}` - Current namespace |
Template literal with variable interpolation in command context
| 317 | - `${DEVSPACE_CONTEXT}` - Current kube context |
Template literal with variable interpolation in command context
| 318 | - `${DEVSPACE_PROFILE}` - Active profile name |
Template literal with variable interpolation in command context
| 319 | - `${DEVSPACE_RANDOM}` - Random 6-char string |
Template literal with variable interpolation in command context
| 320 | - `${DEVSPACE_TIMESTAMP}` - Current UNIX timestamp |
Template literal with variable interpolation in command context
| 370 | ```yaml |
Template literal with variable interpolation in command context
| 409 | ```yaml |
Template literal with variable interpolation in command context
| 442 | ```yaml |
Template literal with variable interpolation in command context
| 487 | ```yaml |
Template literal with variable interpolation in command context
| 556 | ```yaml |
Template literal with variable interpolation in command context
| 673 | ```yaml |
Template literal with variable interpolation in command context
| 679 | ```yaml |
Template literal with variable interpolation in command context
| 709 | ```yaml |
Template literal with variable interpolation in command context
| 814 | ```bash |
Template literal with variable interpolation in command context
| 849 | ```yaml |
Template literal with variable interpolation in command context
| 859 | ```bash |
Access to hidden dotfiles in home directory
| 375 | if [ -f ~/.config/app/config.json ]; then |
Access to hidden dotfiles in home directory
| 376 | echo ~/.config/app/config.json |
Access to hidden dotfiles in home directory
| 517 | - Example: Mounting `credentials.json` into `~/.app/` fails if the app creates `~/.app/cache/` or other files |
Access to hidden dotfiles in home directory
| 578 | mkdir -p ~/.app |
Access to hidden dotfiles in home directory
| 581 | ln -sf /tmp/secrets/credentials.json ~/.app/credentials.json |
Access to hidden dotfiles in home directory
| 602 | mkdir -p ~/.app ~/.config/app |
Access to hidden dotfiles in home directory
| 605 | ln -sf /tmp/secrets/credentials.json ~/.app/credentials.json |
Access to hidden dotfiles in home directory
| 606 | ln -sf /tmp/secrets/api-key.txt ~/.config/app/api-key.txt |
Access to hidden dotfiles in home directory
| 607 | ln -sf /tmp/secrets/client-secret.json ~/.app/client-secret.json |
Access to hidden dotfiles in home directory
| 610 | chmod 600 ~/.app/credentials.json |
Access to hidden dotfiles in home directory
| 640 | subPath: credentials.json # Fails if app writes to ~/.app/ |
Access to hidden dotfiles in home directory
| 649 | ln -sf /tmp/secrets/credentials.json ~/.app/credentials.json |
Access to hidden dotfiles in home directory
| 695 | ls -la ~/.app/ |
Access to hidden dotfiles in home directory
| 696 | cat ~/.app/credentials.json |
Access to hidden dotfiles in home directory
| 702 | ln -sf /tmp/secrets/credentials.json ~/.app/credentials.json |
Access to .env file
| 485 | ### Dynamic Secret Detection from .env |
Access to .env file
| 492 | if [ -f .env ]; then |
Access to .env file
| 493 | cat .env | grep -v '^#' | grep -v '^$' | \ |