Escaping a virtual machine does not require skill. It only requires that:
- A known vulnerability exists in the VM.
- The attacker downloads and uses the exploit.
The Internet is a fabulous thing; it allows people to do a lot of things that they don't actually understand.
In any case, if you dutifully apply security updates to your VM solution (i.e. when VirtualBox tells you that a new version available, you don't tarry: you download and install that new version right away), then risks of a successful escape are slim. An "unskilled" attacker can only apply known exploits for known vulnerabilities, and the VM vendor also keeps track of such vulnerabilities. The relevant notion here is that of a Zero-day: an attack that the attacker knows of before everybody else; your assumption of "unskilled attacker" really means that the attackers cannot use zero-day vulnerabilities.
That being said, while you can assume that your VM is robust, there still are risks of mis-configuration. VM solutions, in particular VirtualBox, allow for "shortcuts" between the guest and the host. VirtualBox calls these guest additions. In particular, these allow for shared folders; but also mouse integration, clipboard access, 3D graphics fall-through... these are so many escape routes by which hostile guest code could impact the host.
An important point is that "guest additions" are drivers installed in the guest, which exercise extra functionalities offered by the VM. If you do not install the guest additions, then the escape hole may still be there, ready to be used. For instance, to prevent an hostile guest from accessing shared folders, you must disable it (or not enable it) from the VM settings.
Similarly, if you let the VM use the default network settings (NAT), then the hostile code can do network calls to other machines within your local network.
Therefore, you must review all VM settings to make sure that you deactivate all features that could allow for an escape or unwanted impact outside of the guest. In particular, take care of the network configuration (it is simpler if you deactivate it altogether, or use internal networking).