Skill Detail

Capture low-level Kubernetes runtime evidence with Inspektor Gadget

Run named Inspektor Gadget traces and snapshots when an agent needs eBPF-backed runtime evidence from pods, containers, or nodes that ordinary logs and metrics do not expose.

Runbooks & DiagnosticsMulti-Framework
Runbooks & Diagnostics Multi-Framework Security Reviewed
⭐ 2.8k GitHub stars
INSTALL WITH ANY AGENT
npx skills add agentskillexchange/skills --skill capture-low-level-kubernetes-runtime-evidence-with-inspektor-gadget Copy
Works best when you want a reusable capability, not another fragile one-off prompt.
At a glance
Tools required
Inspektor Gadget installed on Kubernetes or Linux with permissions to run gadgets
Install & setup
Install kubectl-gadget via krew or install the ig binary, then run a named gadget such as kubectl gadget run trace_exec:latest or ig run trace_open:latest against the target environment.
Author
Inspektor Gadget
Publisher
Organization
Last updated
Apr 20, 2026
Quick brief

Use Inspektor Gadget when an agent needs kernel-level or container-runtime evidence to explain behavior that higher-level telemetry missed. It runs named gadgets such as trace_exec, trace_tcp, and snapshot_process to collect targeted eBPF-backed data from Kubernetes workloads and Linux hosts.

How it works

What this skill actually does

Invoke it during deep incident response, runtime debugging, and low-level troubleshooting after the usual logs, events, and dashboards stop being enough. The scope boundary is clear: this skill is about selecting and running purpose-built gadgets to capture specific runtime evidence, not about serving as a generic Kubernetes management or observability product card.