escaping-containers-to-host

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These links include direct GitHub release binaries and public PoC/pentest repositories (direct binary downloads and exploit code from personal/third‑party repos), which are common distribution vectors for malware or untrusted exploits and should be treated as high risk unless verified.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains explicit, actionable container escape and host-compromise instructions (cgroup release_agent, Docker socket abuse, hostPath tampering, and runC CVE exploits) including commands to read /etc/shadow and install SSH keys — enabling clear host compromise.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches and installs remote executables at runtime (which will be executed) via these URLs: https://github.com/stealthcopter/deepce.git, https://github.com/genuinetools/amicontained/releases/download/v0.4.9/amicontained-linux-amd64, and https://github.com/cdk-team/CDK/releases/latest/download/cdk_linux_amd64, so they are runtime external dependencies that download and run code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to perform container escape techniques that modify host system files (e.g., write/read /etc/shadow, add SSH keys, drop manifests), run privileged containers via the Docker socket, and otherwise gain host-level code execution, which directly compromises the machine state.