The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides commands to perform Docker container escapes and achieve root privileges on the host system by leveraging the Docker socket, docker group membership, and privileged container modes. Evidence includes the use of chroot and mount commands to access the host filesystem from within a container.
[COMMAND_EXECUTION]: The skill includes procedures for establishing persistence on the host system, such as injecting a high-privilege user into /etc/passwd, adding unauthorized SSH keys to the host's authorized_keys file, and creating SUID binaries (chmod u+s).
[DATA_EXFILTRATION]: The instructions detail how to read sensitive host files, specifically /etc/shadow, by mounting host volumes into containers to bypass standard file permissions.
[COMMAND_EXECUTION]: The skill uses curl to interact directly with the Docker Unix socket (/var/run/docker.sock) via the REST API to manage containers and potentially execute commands on the host.

docker-privesc