escaping-hardened-containers
Fail
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous instructions for executing powerful system commands to manipulate namespaces, cgroups, and capabilities (e.g.,
unshare,nsenter,mount,mknod) with the explicit goal of escaping container isolation and gaining host access. - [CREDENTIALS_UNSAFE]: The instructions include patterns for reading highly sensitive host-level information, including
/etc/shadow, host environment variables, and SSH keys, which can lead to credential harvesting. - [EXTERNAL_DOWNLOADS]: The skill utilizes
curlto interact with the Docker socket and cloud provider metadata services (169.254.169.254), providing mechanisms to retrieve sensitive cloud credentials and instance metadata. - [REMOTE_CODE_EXECUTION]: Automated scanning identified a pattern where data fetched via a socket is piped to
python3. While the skill uses this for JSON formatting (python3 -m json.tool), this structure represents a potential code execution vector if the source data is manipulated. - [DATA_EXFILTRATION]: The skill details techniques to transfer sensitive data across the container-host boundary, such as using hostPath mounts or cgroup release agents to write container data into host filesystems.
Recommendations
- HIGH: Downloads and executes remote code from: http://localhost/containers/json - DO NOT USE without thorough review
Audit Metadata