自动化部署 K3s Kubernetes 集群到多台 Linux 服务器。支持自动镜像拉取、网络配置检测、CNI 插件安装。使用场景：(1) 从零部署 K3s 集群，(2) 修复 NotReady 节点，(3) 批量部署多节点集群。触发条件：用户提到 K3s、Kubernetes 部署、集群安装、节点加入等。

This skill appears to implement a working K3s deployment but is sloppy and potentially unsafe in places — treat it as suspicious until you review and harden it: - Don't pass plaintext passwords on the command line. Prefer SSH key-based auth or at least SSHPASS via secure environment variables, and avoid storing passwords in shell history or using unsecured process arguments. - Inspect the scripts locally before running. Pay attention to lines that write /tmp/k3s-token.txt, modify kubeconfigs, create /etc/cni files, and run curl https://get.k3s.io. These reveal or expose cluster credentials. - The package declares no required tools but the scripts require ssh/sshpass/scp, curl, docker/containerd, kubectl and systemctl — ensure those exist and that use of sshpass is acceptable in your environment. - The scripts change kubeconfig addresses (attempts to replace 127.0.0.1 with 0.0.0.0 and $host). Verify and correct that behavior so you don't accidentally expose the API server to all interfaces. - Run the deployment first in an isolated test environment (throwaway VMs) to validate behavior and to see exactly what files are created and what network connections are made (image registries, get.k3s.io). - After a successful run, rotate any tokens/credentials that were generated or exposed and remove temporary files like /tmp/k3s-token.txt. Limit access to generated kubeconfigs and store them securely. - Consider using a vetted deployment tool or implementing SSH key auth and vault-backed secrets in place of passing passwords. If you need help auditing or hardening the scripts, review the exact lines that use sshpass, echo/piping of passwords, and kubeconfig edits. Confidence note: the issues look like sloppy/insecure engineering rather than explicit malicious behavior, but the combination of undeclared credential use, plaintext passwords, and token exposure justifies caution.

Type: OpenClaw Skill Name: k3s-deploy Version: 1.0.0 The skill bundle automates K3s cluster deployment but exhibits high-risk credential handling by requiring root passwords as plaintext command-line arguments for use with `sshpass` in `scripts/deploy-k3s.sh`. While these capabilities are functionally aligned with the stated purpose of remote multi-node installation, the insecure management of sensitive credentials and the execution of broad system-level modifications via SSH (e.g., disabling swap, modifying /etc/fstab) represent significant security risks. No evidence of intentional data exfiltration or hidden backdoors was identified.