The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill requires administrative privileges for certain operations. Specifically, the container system dns create and container system dns delete commands must be run with sudo to modify the host resolver configuration as described in references/commands.md and references/configuration.md.
[PERSISTENCE]: The skill implements persistence by registering background services (container-apiserver and helpers) via launchd when container system start is executed. These services are designed to remain active across user sessions and are managed by the container system command group.
[REMOTE_CODE_EXECUTION]: The skill documents the container system kernel set command, which allows the runtime to download and install Linux kernels from arbitrary remote URLs using the --tar flag. This functionality provides a mechanism for code execution at the kernel level if directed toward a malicious source.
[EXTERNAL_DOWNLOADS]: The instructions guide users to download a signed .pkg installer from Apple's official GitHub releases page. Additionally, the skill may download recommended kernels and OCI images from remote registries during normal operation.
[COMMAND_EXECUTION]: The skill makes extensive use of the container CLI and its subcommands to modify local system state, including managing virtual machines, configuring virtual networks, and creating persistent volumes.
[INDIRECT_PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection as it processes untrusted external data during image builds and container runs.
Ingestion points: The container build command processes local context directories containing Dockerfiles/Containerfiles, and container run/machine create pull images from external OCI registries.
Boundary markers: Each reference file contains an 'Operational boundaries' section that warns users to verify the integrity of images, kernels, and build instructions before execution.
Capability inventory: The skill possesses broad capabilities including file system modification, network configuration, privileged command execution (via sudo), and kernel installation.
Sanitization: The instructions do not include explicit sanitization of input data, instead relying on the isolation provided by the per-container virtual machine architecture and manual user review.

apple-container