A3S-Lab

Privilege Escalation Triage — Development skill for Claude Code

Development community

Decide whether an observed privilege change (setuid/ptrace/capability) is a real escalation attempt or benign.

How to install Privilege Escalation Triage

Installs to ~/.claude/skills/a3s-lab-sentry-privilege-escalation-triage/SKILL.md

Terminal

mkdir -p ~/.claude/skills/a3s-lab-sentry-privilege-escalation-triage && curl -fsSL https://raw.githubusercontent.com/A3S-Lab/Sentry/HEAD/skills/privilege-escalation-triage.md -o ~/.claude/skills/a3s-lab-sentry-privilege-escalation-triage/SKILL.md

Restart Claude Code, or start a new session, for it to be picked up.

What Privilege Escalation Triage does

name: privilege-escalation-triage description: Decide whether an observed privilege change (setuid/ptrace/capability) is a real escalation attempt or benign.

Privilege-escalation triage

Use this when L1/L2 flagged a `SecurityAction` (setuid-root, ptrace) or a tool that changes privilege.

What to establish

Who. Which agent/process, running as which uid, in which container/cgroup. A web-facing agent escalating to root is far more serious than an init script dropping privi