performing-container-escape-detection

Detects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous capability assignments, and host path mounts using the kubernetes Python client. Identifies CVE-2022-0492 style escapes via cgroup abuse. Use when auditing container security posture or investigating escape attempts.

Ir a la instalación

Repositorio: xalgord/xalgorix
Última actividad en el origen: 6 de junio de 2026 a las 16:41
Idioma detectado de SKILL.md: inglés
Estrellas: 813
Forks: 146

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/xalgord/xalgorix --skill performing-container-escape-detection

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

Ver todos los de este repositorio

Performing Container Escape Detection

When to Use

When conducting security assessments that involve performing container escape detection

When following incident response procedures for related security events

When performing scheduled security testing or auditing activities

When validating security controls through hands-on testing

Detection Gaps & Validation

A pod-spec audit that only reads securityContext.privileged misses most real escape paths. The fields below are the ones detection scripts routinely skip:

Beyond privileged: check allowPrivilegeEscalation, procMount: Unmasked, seccompProfile: Unconfined/absent, and added capabilities individually - SYS_ADMIN, SYS_PTRACE, DAC_READ_SEARCH (CVE-2022-0492 via cgroup release_agent), NET_RAW, SYS_MODULE, BPF. A non-privileged pod with SYS_ADMIN still escapes.

All container types: iterate spec.containers and spec.initContainers and spec.ephemeralContainers - debug/ephemeral containers are a common blind spot.

Host exposure: hostPID/hostIPC/hostNetwork, and hostPath mounts beyond / and /etc (/var/run/docker.sock, /var/run/containerd, /proc, /sys, kubelet dirs). Check the mount is writable, not just present.

Pod-level vs container-level securityContext: a setting on one does not imply the other; read both.

Validate, don't conclude-safe from one field: a single clean field is not a clean pod - enumerate the full matrix above. Where authorized, confirm a finding by actually attempting the escape in a throwaway namespace (e.g. mount host root from a SYS_ADMIN pod, or read /host/etc/shadow via a hostPath mount). Cross-check the live audit against runtime detection (Tetragon/Falco) - a static "no privileged pods" result does not mean no escape occurred.

Prerequisites

Familiarity with container security concepts and tools