Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hypnguyen1209/offensive-claude --skill container-k8s-escapegit clone --depth 1 https://github.com/hypnguyen1209/offensive-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hypnguyen1209/offensive-claude/container-k8s-escape)<a href="https://agentmods.dev/skills/hypnguyen1209/offensive-claude/container-k8s-escape"><img src="https://agentmods.dev/badge/skills/hypnguyen1209/offensive-claude/container-k8s-escape/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hypnguyen1209/offensive-claude/container-k8s-escape"><img src="https://agentmods.dev/badge/skills/hypnguyen1209/offensive-claude/container-k8s-escape.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.02936 |
| Opus 5 | $0.00033 | $0.01468 |
| Sonnet 5 | $0.00013 | $0.00587 |
| Haiku 4.5 | $0.00007 | $0.00294 |
Grade C, and why
container-k8s-escape scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
python3 scripts/k8s_rbac_audit.py --kubeconfig ~/.kube/config --dangerous Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| docker.sock abuse | `/var/run/docker.sock` mounted; `curl --unix-socket` create privileged container | Falco "Docker socket access by unexpected proc"; new privileged container event | Spawns a *new* privileged contain How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Container Breakout & Kubernetes Escape
When to Activate
- You have code execution inside a container/pod and want to break out to the host node
- Auditing a Kubernetes cluster for RBAC privilege-escalation and lateral-movement paths
- Assessing runc/containerd/BuildKit/Docker runtime versions against known escape CVEs
- A pod is privileged, has dangerous capabilities, hostPath/hostPID/hostNetwork, or a mounted docker.sock
- Attacking GPU/AI workloads using the NVIDIA Container Toolkit
- Testing ingress-nginx / admission-controller exposure for unauthenticated RCE
- Post-escape: pivoting from one node to full cluster takeover (kubelet, SA tokens, etcd, cloud IMDS)
- Building Falco/Sigma detections for container-escape behavior (defensive validation)
Technique Map
| Technique | ATT&CK | CWE | Reference | Script |
|---|---|---|---|---|
| runc working-dir fd leak escape (Leaky Vessels, CVE-2024-21626) | T1611 | CWE-403 | references/runtime-cve-escapes.md | scripts/runc_cwd_escape.py |
runc masked-path / /dev/null symlink escape (CVE-2025-31133) |
T1611 | CWE-367 | references/runtime-cve-escapes.md | scripts/runc_cwd_escape.py |
runc /dev/console bind-mount + LSM bypass (CVE-2025-52565/52881) |
T1611 | CWE-363 | references/runtime-cve-escapes.md | scripts/escape_enum.sh |
| BuildKit cache/teardown symlink escape (CVE-2024-23651/52/53) | T1611 | CWE-59 | references/runtime-cve-escapes.md | scripts/escape_enum.sh |
Privileged / CAP_SYS_ADMIN cgroup release_agent escape |
T1611 | CWE-269 | references/privileged-misconfig-escape.md | scripts/release_agent_escape.sh |
core_pattern host-side code exec on crash |
T1611 | CWE-269 | references/privileged-misconfig-escape.md | scripts/release_agent_escape.sh |
hostPID + nsenter into PID 1 namespace |
T1611 | CWE-668 | references/privileged-misconfig-escape.md | scripts/escape_enum.sh |
Mounted docker.sock / containerd.sock host takeover |
T1610 | CWE-668 | references/privileged-misconfig-escape.md | scripts/escape_enum.sh |
hostPath / mount → write host filesystem |
T1611 | CWE-22 | references/privileged-misconfig-escape.md | scripts/escape_enum.sh |
NVIDIAScape LD_PRELOAD OCI-hook escape (CVE-2025-23266) |
T1611 | CWE-426 | references/nvidia-gpu-escape.md | scripts/nvidiascape_build.sh |
| NVIDIA CT TOCTOU mount escape (CVE-2024-0132 / CVE-2025-23359) | T1611 | CWE-367 | references/nvidia-gpu-escape.md | scripts/nvidiascape_build.sh |
| K8s RBAC privesc (verb/wildcard/escalate, SA token theft) | T1078.001 | CWE-269 | references/k8s-rbac-escalation.md | scripts/k8s_rbac_audit.py |
nodes/proxy GET → kubelet WebSocket exec RCE |
T1609 | CWE-863 | references/k8s-rbac-escalation.md | scripts/kubelet_exec.py |
| Anonymous/authed kubelet API exec on :10250 | T1609 | CWE-306 | references/k8s-rbac-escalation.md | scripts/kubelet_exec.py |
| IngressNightmare unauth RCE (CVE-2025-1974 + annotation chain) | T1190 | CWE-94 | references/ingress-admission-attacks.md | scripts/escape_enum.sh |
| Node → cluster pivot (etcd, IMDS, SA-token harvest) | T1613 | CWE-552 | references/node-host-pivot.md | scripts/escape_enum.sh |
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/ingress-admission-attacks.md 6.9 KB
- references/k8s-rbac-escalation.md 7.5 KB
- references/node-host-pivot.md 7.5 KB
- references/nvidia-gpu-escape.md 6.7 KB
- references/privileged-misconfig-escape.md 9.1 KB
- references/runtime-cve-escapes.md 9.3 KB
- scripts/escape_enum.sh 4.5 KB runs code
- scripts/k8s_rbac_audit.py 7.9 KB runs code
- scripts/kubelet_exec.py 5.6 KB runs code
- scripts/nvidiascape_build.sh 4.0 KB runs code
- scripts/release_agent_escape.sh 4.1 KB runs code
- scripts/runc_cwd_escape.py 5.5 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 118 lines · 66 tokens per session scan C d208cf5352f3
container-k8s-escape is a skill published in the GitHub repository hypnguyen1209/offensive-claude (357 stars, last pushed 25d ago), licensed MIT. It adds 66 tokens to every session and 2,936 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
offensive-container-escape
Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAPSYSADMIN, CAPSYSPTRACE, and CAPNETADMIN, cgroup v1…
hunt-k8s
Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated…
deploy
Elixir/Phoenix deployment patterns — Dockerfile, fly.toml, runtime.exs, mix release, rel/ overlays. Use when configuring Fly.io, Docker, CI/CD, health checks, or production migrations.
performing-kubernetes-penetration-testing
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools.
706-technologies-containers-docker
Use when you need framework-agnostic Docker and container image guidance for Java projects - Dockerfile design, multi-stage Maven builds, jlink custom runtimes, micro runtime distributions such as Alpaquita, JVM container ergonomics, non-root execution, image metadata, .dockerignore, reproducible builds, vulnerability…
bt6-queue-audit
Audit the full pull-request and issue queue of a BT6 research or support repository, classifying readiness, evidence risk, and next action without mutating tracker state.