container-security

29

hardw00t

Container and Kubernetes security assessment skill for Docker, Kubernetes, and container orchestration platforms. This skill should be used when scanning container images for vulnerabilities, auditing Kubernetes cluster security, testing container escape scenarios, reviewing Docker configurations, or performing container runtime security analysis. Triggers on requests to scan Docker images, audit Kubernetes security, test container configurations, or assess container orchestration security.

escalating-linux-privileges

5

trilwu

Escalate privileges on Linux systems using SUID/SGID binaries, capabilities, sudo misconfigurations, cron jobs, kernel exploits, and container escapes. Use when performing Linux post-exploitation or privilege escalation.

exploiting-containers

5

trilwu

Escape Docker containers and exploit Kubernetes clusters using privileged containers, Docker socket access, misconfigurations, and API abuse. Use when testing container security or performing container escape.

None

2

mukul975

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators

detecting-container-escape-with-falco-rules

2

mukul975

Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.

kernel-security-skill

1

dtsong

Use this skill when analyzing kernel security at the hardware/software interface — memory management, process isolation, privilege escalation paths, or IOMMU/SMMU configuration. Triggers on "kernel hardening review", "IOMMU bypass analysis", "privilege escalation audit", "container escape assessment", "KASLR/KPTI evaluation". Do NOT use for microarchitectural attacks (use microarch-attack-skill) or physical side-channels (use physical-sca-skill).