offensive-container-escape

Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NET_ADMIN, cgroup v1 notify_on_release escape, runc CVEs such as CVE-2019-5736 and CVE-2024-21626 Leaky Vessels, kernel exploits from within containers, and Dockerfile misconfigurations like --privileged and host namespace sharing. Includes enumeration with capsh, amicontained, deepce, CDK, and nsenter. Maps to MITRE ATT&CK T1611 Escape to Host. Use this skill when the engagement scope includes container breakout, Docker escape, container privilege escalation, host access from container, or when you land inside a containerized environment and need to reach the underlying host.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, mostly actionable container-escape runbook with a clear phased workflow and validation, but it is over-long for a single file, includes concept explanations and a tangential defender section, and inlines material that would benefit from separate reference files.

Suggestions

Trim concept explanations Claude already knows (the container-isolation intro, the '--privileged drops all isolation' aside) and move the 'Detection / Defender View' section to a separate reference file or drop it, since this is an offensive skill.

Split the large CVE catalog (Phase 6) and the Engagement Cheatsheet into one-level-deep reference files (e.g. references/cves.md, references/cheatsheet.md) referenced from SKILL.md, so the main file stays a navigable overview.

Complete the truncated PoCs (shocker.c, CVE-2019-5736, DirtyPipe) with full runnable code or an explicit pointer to the exact external PoC file to execute, so every exploitation step is actionable rather than conceptual.

Dimension	Reasoning	Score
Conciseness	The body is mostly executable commands but carries noticeable padding Claude does not need — the intro paragraph explaining that 'Container isolation relies on Linux namespaces, cgroups, seccomp profiles...', section intros like 'A container run with --privileged drops nearly all isolation...', and a 30-line 'Detection / Defender View' section that is scope creep for an offensive skill.	3 / 5
Actionability	Most sections give copy-paste-ready bash (privileged mount, Docker socket API calls, cgroup release_agent, cheatsheet one-liners), but a few PoCs are incomplete — the shocker.c source is truncated with '// ... (PoC continues)', CVE-2019-5736 defers to an external Go binary, and DirtyPipe says 'Compile exploit' without providing it.	4 / 5
Workflow Clarity	A 6-step Quick Workflow plus sequenced Phases 1–7 give a clear path, and validation appears (Step 5 'Validate host access', inline 'Verify host access'/'Verify you escaped' checks) for these destructive operations; capped below 5 because there are no explicit error-recovery feedback loops.	4 / 5
Progressive Disclosure	No bundle files exist and the entire 670-line guide is inlined in SKILL.md with no one-level-deep references — content that clearly belongs in separate files (CVE reference, tool cheatsheet, defender view) sits inline; section headers provide some structure but no file-level navigation.	3 / 5
	Total	14 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and explicitly covers both what the skill does and when to invoke it, with a clear container-escape niche. Voice is appropriately third-person about the skill with no first/second-person drift.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'privileged container breakout via host filesystem mount and nsenter', 'Docker socket abuse through /var/run/docker.sock', 'cgroup v1 notify_on_release escape', named capability exploitation (CAP_SYS_ADMIN/SYS_PTRACE/NET_ADMIN), specific runc CVEs, and named enumeration tools — giving comprehensive coverage rather than vague claims.	5 / 5
Completeness	It explicitly answers 'what' (the enumerated escape technique categories and tools) and 'when' (the explicit 'Use this skill when the engagement scope includes...' trigger clause with concrete trigger phrases), satisfying the top anchor.	5 / 5
Trigger Term Quality	The 'Use this skill when...' clause surfaces natural phrases a user would actually say — 'container breakout', 'Docker escape', 'container privilege escalation', 'host access from container' — plus synonyms across Docker/containerd/Podman, matching the comprehensive-synonyms anchor.	5 / 5
Distinctiveness Conflict Risk	The container-escape-to-host niche (MITRE T1611) with runtime-specific triggers is clearly distinct from general privilege-escalation or hardening skills, with minimal overlap risk.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (673 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: SnailSploit/Claude-Red
Path: Skills/container/offensive-container-escape/SKILL.md
Commit: 24d7968

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.