The Agent Skills Directory

[COMMAND_EXECUTION]: The provided Python scripts (scripts/agent.py and scripts/process.py) use the subprocess module to interface with container runtimes.
Evidence: The scripts call docker ps, docker inspect, and kubectl get pods to retrieve security-related metadata about running environments.
These operations are performed with list-based arguments, which prevents shell command injection.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing Falco using Helm from the official Falco Security charts.
Evidence: helm install falco falcosecurity/falco using the repository https://falcosecurity.github.io/charts.
This is a standard deployment method for a well-known and trusted security project.
[SAFE]: The skill's behavior is entirely consistent with its stated purpose of container security auditing.
All sensitive file paths mentioned (e.g., /var/run/docker.sock, /proc/kcore) are used as indicators of interest for detection, not for unauthorized access.
The external URL referenced (book.hacktricks.xyz) is a well-known industry resource for security research.

detecting-container-escape-attempts