How to use the Container Escape Analysis (CTF) agent skill

What an agent skill is and what this one does

An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a request matches the skill's description. This one is a specialist checklist for container isolation work in CTF challenges.

Once active, the agent works through a fixed sequence: map the isolation (namespaces, cgroups, capabilities, seccomp, AppArmor or SELinux, mounts and runtime sockets), separate the exploit prerequisite from the primitive and from the proof of boundary crossing, then reduce the work to one minimal chain from container context to a host-relevant effect.

• Records kernel version, runtime options and reachable syscall surface
• Requires before-and-after evidence of identity, namespace, mount or process visibility
• Distinguishes crash-only behaviour from stable capability gain
• Classifies the root cause as kernel vulnerability, runtime misconfiguration, capability overgrant or namespace leak
• Replies in Simplified Chinese unless the user explicitly asks for English

Install the skill from the ZIP

Download the ZIP for this skill from our page and unzip it. The folder should contain SKILL.md, references/kernel-container-escape.md and agents/openai.yaml.

For a personal install, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings → Capabilities → Skills and upload the skill there.

• Personal: ~/.claude/skills/
• Per project: .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills, then upload

Install the parent skill first

This skill is a downstream specialisation. The source says it should only run after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership and evidence priorities. If that has not happened, the skill tells the agent to return to the parent first.

So the parent skill, ctf-sandbox-orchestrator, must be installed and active before you rely on this one.

How to trigger the skill with natural requests

You do not need a special command. The agent matches your request against the skill description. The description names the kinds of request it covers, so phrase your request around the boundary question. Remember the parent skill must already be active, and the sandbox assumptions must already be set.

Good triggers focus on proving or analysing a crossing inside a sandbox you are authorised to test.

• Analyse the container-to-host escape paths in this sandbox challenge.
• Check whether this kernel exploit primitive actually crosses the namespace boundary.
• What are the kernel exploit prerequisites for this container?
• Review the capability set and tell me if any capability is being misused.
• Prove whether this primitive crosses the sandbox boundary, with before-and-after evidence.

What you need before you start

The source lists these requirements. It names no specific tools beyond the references document, so check your own environment for what you need.

The skill does not run scripts and does not use the network, according to the file listing. It is a set of instructions, so the work itself happens through whatever tools your agent runtime and sandbox provide.

• The parent skill ctf-sandbox-orchestrator installed and active
• A SKILL.md-compatible agent runtime
• A CTF sandbox environment you are authorised to test

Safety notes: scope, production and authorisation

The skill is built to demonstrate escapes and has no legal or scope checks of its own. Only use it on systems you own or have written authorisation to test.

The workflow includes instrumented exploit trials that could crash or compromise a system. Do not run it on production hosts or shared infrastructure. Keep instrumented observations separate from the pristine challenge path, as the skill itself instructs.

• Do not use it against systems without written authorisation
• Do not use it on production or shared infrastructure
• Reset to a clean baseline so the chain can be reproduced

Tips for getting useful results

Give the agent the kernel version, runtime type and any config hints you have, since the skill asks for them early. Ask for one minimal chain rather than several primitives mixed together, because the checklist warns against mixing primitives before one chain is proven.

If the path mostly relies on credential replay after an initial foothold, the skill says to hand off to a Linux credential pivot skill instead.

• Provide kernel version, runtime type and namespace or capability details up front
• Ask for one reproducible chain at a time
• Expect crash-only results to be reported as unproven