The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill details multiple techniques for breaking out of container isolation, including mounting the host filesystem via the Docker socket (/var/run/docker.sock) and using the release_agent cgroup trick to execute commands on the host kernel. It specifically targets 'privileged' containers and those with dangerous capabilities like CAP_SYS_ADMIN.
[COMMAND_EXECUTION]: Provides templates for high-risk commands intended to gain host access, such as docker -H unix://... run -v /:/host ... and using nsenter to inject into the namespaces of host processes (PID 1).
[DATA_EXFILTRATION]: Instructs the agent to access highly sensitive host-level files and credentials, including /etc/shadow, SSH private keys, Kubelet configuration files, and cloud provider metadata credentials (IMDS) to facilitate lateral movement.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a guide that influences agent behavior toward high-risk system operations when specific environment signals (like /.dockerenv) are detected.
Ingestion points: The instructions in SKILL.md are ingested into the agent's context to guide its behavior in containerized environments.
Boundary markers: Absent. There are no delimiters or instructions to treat the data as untrusted or to ignore potentially embedded malicious instructions from the container environment.
Capability inventory: The skill describes the use of docker, mount, nsenter, and network requests to cloud metadata services.
Sanitization: Absent. No validation or filtering of the container environment's state is suggested before attempting escalation.

cloud-container-escape