This skill allows arbitrary command execution, privilege escalation
Claims to do
Layer - Layer Authoring: A **layer** is a directory under `layers/<name>/` that installs a single concern. Layers are the building blocks of container images in overthink. Each layer can declare packages, dependencies, environment variables, ports, services, volumes, and command aliases.
Actually does
This skill describes how to author 'layers' using `ov` commands like `ov new layer` and `ov list layers`. It details the structure and fields of `layer.yml` and other manifest files (`root.yml`, `user.yml`, `pixi.toml`, `package.json`, `Cargo.toml`) to declare packages (RPM, Deb, Pacman, AUR, Python, Node.js, Rust), environment variables, ports, services, volumes, security settings, secrets, and inter-container communication. It outlines how these files are processed to build container images.
Shell command execution function detected
system (
The skill allows defining custom logic and scripts (`root.yml`, `user.yml`, `build.sh`, `service` field, `aliases` field, `hooks` field) that execute arbitrary commands. `root.yml` and the `service` field can execute as `root`, while `user.yml`, `build.sh`, `aliases`, and `hooks` execute as `user`, providing extensive control over the build and runtime environment.
root.yml | root | Custom root install logic (Taskfile). user.yml | user | Custom user install logic (Taskfile). build.sh | user | Optional post-install script service | multiline string | Supervisord [program:<name>] fragment aliases | []AliasYAML | Host command aliases hooks | HooksConfig | Lifecycle hooks
The `security` field allows setting `privileged: true`, adding capabilities (`cap_add`), mounting devices, and defining arbitrary host/tmpfs mounts. Additionally, the `libvirt` field allows injecting raw Libvirt XML snippets. These mechanisms can be used to escape the container/VM sandbox or escalate privileges on the host system.
security:
privileged: false
cap_add:
- SYS_PTRACE
devices:
- /dev/dri
mounts:
- /dev/input:/dev/input:rw
libvirt | []string | Raw libvirt XML snippets injected into VM domain XMLThe `env_provides` and `mcp_provides` fields allow injecting environment variables and MCP server configurations into *other* containers. This capability can be leveraged to influence the behavior of dependent services, potentially leading to lateral movement, data exfiltration, or command execution in other parts of the multi-container system.
env_provides:
OLLAMA_HOST: "http://{{.ContainerName}}:11434"
mcp_provides:
- name: jupyter-colab
url: "http://{{.ContainerName}}:8888/mcp"The `secrets` field allows defining the `target` mount path and `env` fallback variable for Podman secrets. An attacker could manipulate these paths or environment variable names to redirect or expose sensitive credentials within the container, especially when combined with arbitrary command execution capabilities.
secrets:
- name: api-key
target: /run/secrets/api_key
env: API_KEYThe AUR package build process explicitly configures 'Passwordless sudo is configured for the build user in the AUR build stage.' This significantly lowers the bar for privilege escalation during the build process if an attacker can inject malicious AUR packages or build scripts.
Passwordless sudo is configured for the build user in the AUR build stage.
[](https://mondoo.com/ai-agent-security/skills/github/overthinkos/overthink-plugins/layer)<a href="https://mondoo.com/ai-agent-security/skills/github/overthinkos/overthink-plugins/layer"><img src="https://mondoo.com/ai-agent-security/api/badge/github/overthinkos/overthink-plugins/layer.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/overthinkos/overthink-plugins/layer.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.