The Agent Skills Directory

[DATA_EXFILTRATION]: The skill mounts several sensitive host-path credential and configuration files into the container to preserve developer identity. This includes files such as ~/.gitconfig, ~/.config/git/credentials, ~/.cursor/cli-config.json, ~/.claude/settings.json, and ~/.claude/.credentials.json. Mounting these files exposes host secrets to the container's environment.
[PRIVILEGE_ESCALATION]: The skill provides an option to mount the Docker socket (/var/run/docker.sock) into the devcontainer. This effectively grants the container root-level privileges on the host machine, as it allows the container to control the host's Docker daemon. The skill documentation includes an explicit warning about this security trade-off.
[EXTERNAL_DOWNLOADS]: The skill's entrypoint script downloads and executes installation scripts for CLI tools from claude.ai (Anthropic) and cursor.com. These are legitimate, well-known, or trusted services.
[COMMAND_EXECUTION]: The skill uses various shell commands and tools (docker, make, useradd, chmod) to create users, set permissions, and manage container lifecycles. It also generates a Makefile on the host to provide a consistent interface for managing the environment.
[DYNAMIC_EXECUTION]: The skill dynamically generates sensitive environment configuration files, including a Dockerfile stage, Docker Compose overrides, and an entrypoint shell script. These are constructed based on the host's UID/GID and discovered project dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect injection surface as it reads and parses untrusted files from the repository (e.g., go.mod, package.json, Makefile) to determine the necessary toolchain. While these files are used to template the environment, a malicious repository could attempt to influence the setup process. Evidences:
Ingestion points: Reads repository configuration files during the 'Explore' phase in SKILL.md.
Boundary markers: No explicit boundary marking or input validation is performed on the content of the discovered files.
Capability inventory: Comprehensive file writing, image building, and shell execution capabilities across all scripts.
Sanitization: No sanitization of the values extracted from repository files before inclusion in Dockerfiles or scripts.

setup-devcontainer