The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to read highly sensitive files including service account tokens at /var/run/secrets/kubernetes.io/serviceaccount/token, host system secrets in /etc/shadow, and Kubernetes API secrets. It also targets cloud-specific metadata services (AWS IMDS, GCP Metadata Server, and Azure IMDS) to extract IAM security credentials and OAuth2 access tokens.
[DATA_EXFILTRATION]: Contains patterns for exfiltrating stolen service account tokens to an external domain (attacker.com) by embedding them in DNS queries using nslookup.
[PRIVILEGE_ESCALATION]: Provides specific techniques for container escape and host compromise. This includes using nsenter to enter host namespaces from a privileged container, and deploying new pods with hostPID, hostNetwork, and hostPath configurations that mount the host's root filesystem (/). It also includes instructions for abusing RBAC permissions to create cluster-admin bindings.
[PERSISTENCE]: Includes methods for maintaining long-term access to a cluster by deploying a DaemonSet that runs on every node to maintain a command-and-control (C2) beacon or reverse shell. Additionally, it provides instructions for modifying the host's authorized_keys file to grant SSH access.
[COMMAND_EXECUTION]: Orchestrates lateral movement and remote command execution by using kubectl exec and abusing the Kubelet API (port 10250) to run commands in containers, effectively bypassing standard API server authorization.
[DYNAMIC_EXECUTION]: Frequently utilizes python3 -c to execute inline scripts that dynamically parse and manipulate JSON data retrieved from Kubernetes APIs and external services.
[INDIRECT_PROMPT_INJECTION]: The skill represents a significant attack surface as it ingests untrusted data from Kubernetes API responses, Kubelet metrics, and cloud metadata services. This data is subsequently used to build and execute further shell commands and Python scripts without validation or sanitization, which could allow a malicious cluster environment to influence the agent's actions.
Ingestion points: Kubernetes API endpoints (via curl and kubectl), Kubelet API responses, and Cloud Metadata Service responses (AWS/GCP/Azure).
Boundary markers: None identified in the instructional content.
Capability inventory: Full subprocess control via kubectl, curl, nsenter, and file-writing capabilities on the host filesystem.
Sanitization: Minimal; the skill relies on standard JSON parsing without specific validation of the values returned from the cluster environment.

offensive-k8s-attacks