cloud-docker-api-abuse
Warn
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: MEDIUMPRIVILEGE_ESCALATIONPERSISTENCECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill provides explicit instructions for escaping container environments to gain root access on the host system. It details the use of bind-mounts (
-v /:/host) combined withchroot /hostto bypass the container boundary and operate directly on the host OS. - [PERSISTENCE]: The instructions include a step to establish persistent access by injecting an SSH key into the host's
/root/.ssh/authorized_keysfile. - [COMMAND_EXECUTION]: The skill outlines the execution of host-impacting commands, such as mounting host disks (
mount /dev/sdaN /mnt) and manipulating Docker daemon settings viaDOCKER_HOSTenvironment variables to control containers and host resources. - [DATA_EXFILTRATION]: The method describes techniques for accessing sensitive host information, including reading
/etc/shadow, pulling WindowsNTDS/SAM files, and inspecting container image layers and environment variables for credentials.
Audit Metadata