The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill details multiple techniques for container escape to gain host-level access. These include mounting host devices to a container directory and using chroot to enter the host environment, as well as abusing cgroups release_agent to execute arbitrary commands on the host.
[EXTERNAL_DOWNLOADS]: The skill pulls automated exploitation scripts from untrusted external repositories, specifically deepce.sh from the stealthcopter GitHub account. Furthermore, external security scanners have flagged the reference links to book.hacktricks.xyz included in the skill as potentially malicious.
[REMOTE_CODE_EXECUTION]: The skill enables the download and execution of remote shell scripts using the wget [URL] && chmod +x [FILE] && ./[FILE] pattern, allowing for the execution of unvetted code directly within the agent's operating context.
[COMMAND_EXECUTION]: The skill involves the use of highly privileged commands such as mount, chroot, docker run --privileged, and kubectl exec. It also suggests using gdb to attach to PID 1 and execute arbitrary code via the system() call.
[DATA_EXFILTRATION]: Instructions are provided to locate and read sensitive files, including the host's /etc/shadow file and Kubernetes service account tokens. These resources are often targeted for exfiltration to compromise the wider infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates an indirect injection vulnerability by accepting untrusted user inputs (like container IDs or namespaces) and interpolating them into executable shell commands without visible sanitization.
Ingestion points: User-provided container identifiers and registry URLs in shell command blocks within SKILL.md.
Boundary markers: None present; the skill lacks delimiters or instructions to prevent the agent from following embedded malicious commands in user data.
Capability inventory: The skill has extensive capabilities including file system access, network communication, and system administration privileges.
Sanitization: No validation or sanitization of input data is defined.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic execution methods such as using gdb to inject code into running processes and exploiting kernel-level vulnerabilities like Dirty Pipe and DirtyCow to bypass memory protections and escalate privileges.

exploiting-containers