The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run-ascend-container.sh is vulnerable to shell argument injection. The variables $CONTAINER_NAME and $IMAGE are passed unquoted to docker run commands within the run_privileged, run_basic, and run_full functions. This allows a malicious or poisoned input to inject additional Docker CLI flags (e.g., --volume /:/host) that could bridge the container-host boundary.
[PRIVILEGE_ESCALATION]: The skill encourages the use of highly privileged container configurations. The 'Privileged' mode explicitly uses the --privileged, --net=host, and --ipc=host flags, which grant the container near-total access to the host's hardware and kernel interfaces. Additionally, the 'Full' mode mounts the host's /usr/local/sbin directory with write permissions, creating a vector for host takeover by overwriting critical system binaries from within the container.
[DATA_EXPOSURE]: All container modes defined in the skill mount the entire host /home directory into the container workspace (-v /home:/home). This practice exposes all user-sensitive data, including SSH keys, environment files, and personal documents, to any process running inside the container.
[INDIRECT_PROMPT_INJECTION]: The skill processes externally sourced information (Docker image names and container identifiers) and interpolates them directly into shell commands. This creates an exploitation surface where malicious data processed by the agent could be used to manipulate the Docker environment without sanitization, validation, or boundary markers.

ascend-docker