What problem does it solve? In CTF sandbox challenges, proving a real container-to-host escape requires more than triggering a crash or gaining container root. This Skill provides a structured methodology for mapping kernel and container isolation, separating exploit prerequisites from primitives, and capturing decisive evidence that a boundary crossing actually occurred. ## Core Features & Use Cases - Isolation Mapping: Records namespaces, cgroups, seccomp profiles, capabilities, LSM state, mounts, and runtime sockets tied to exact node context. - Primitive Verification: Distinguishes crash-only behavior from stable capability gain by capturing before/after identity, namespace, and mount state. - Escape Chain Reduction: Compresses findings into a minimal prerequisite-to-primitive-to-boundary-crossing chain with root cause classification (kernel vulnerability, runtime misconfiguration, capability overgrant, or namespace leak). - Use Case: During a kernel pwn CTF challenge, use this Skill after the sandbox orchestrator has established assumptions to verify whether a syscall-triggered primitive actually crosses into host context rather than just crashing the container. ## Quick Start Ask the agent to map the container's namespace, capability, and seccomp state and then prove whether your exploit primitive crosses into the host context.
