From asi
Detects Kubernetes container escape attempts via privileged checks, dangerous capabilities, host mounts, namespaces, and cgroup abuse using Python client. For security audits and investigations.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When conducting security assessments that involve performing container escape detection
Audits Kubernetes pods for container escape vectors including privileged containers, dangerous capabilities, host mounts, namespace sharing, and cgroup vulnerabilities using Python client.
Detects Kubernetes container escape attempts by checking privileged mode, dangerous capabilities, host namespace sharing, risky hostPath mounts, and cgroup abuses like CVE-2022-0492 using Python Kubernetes client. For auditing cluster security.
Detects and prevents privilege escalation in Kubernetes pods using Pod Security Admission, OPA Gatekeeper policies, and Falco runtime monitoring for security contexts, capabilities, and syscalls.
Share bugs, ideas, or general feedback.
Audit Kubernetes pods for container escape vectors including privileged mode, dangerous capabilities, host namespace sharing, and writable hostPath mounts.
from kubernetes import client, config
config.load_kube_config()
v1 = client.CoreV1Api()
pods = v1.list_pod_for_all_namespaces()
for pod in pods.items:
for container in pod.spec.containers:
sc = container.security_context
if sc and sc.privileged:
print(f"PRIVILEGED: {pod.metadata.namespace}/{pod.metadata.name}")
Key escape vectors:
# Check for docker socket mounts
for vol in pod.spec.volumes or []:
if vol.host_path and "docker.sock" in (vol.host_path.path or ""):
print(f"Docker socket exposed: {pod.metadata.name}")