The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides explicit instructions for escaping container boundaries to gain host-level root access. It describes using the Docker daemon to mount the host's root filesystem using the -v /:/host flag and then using chroot to gain shell access as the root user.
[PERSISTENCE]: The method includes a step for maintaining long-term access to a compromised host by dropping an SSH public key into the /root/.ssh/authorized_keys file.
[COMMAND_EXECUTION]: Detailed commands are provided for executing high-risk operations, such as running arbitrary containers with host mounts and interacting with the host's storage devices using fdisk and mount from within a privileged container.
[DATA_EXFILTRATION]: The instructions guide the agent to target and read sensitive system files including /etc/shadow, Windows NTDS and SAM hives, and credential secrets stored in container environment variables or image layers.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted output from remote Docker APIs and local system commands without sanitization. (1. Ingestion points: Docker API response from curl and docker ps output; 2. Boundary markers: Absent; 3. Capability inventory: docker run with host mounts, chroot, and file system access; 4. Sanitization: None).

cloud-docker-api-abuse