The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-supplied data from $ARGUMENTS directly into shell commands, including mkdir, cp, and gh repo create. This pattern is vulnerable to command injection if the workspace name or parent path contains shell metacharacters (e.g., ;, &, |, or backticks).
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data through positional arguments and flags.
Ingestion points: User input captured via $ARGUMENTS in SKILL.md.
Boundary markers: Absent; there are no explicit delimiters or instructions to ignore control characters in the input.
Capability inventory: The skill has access to file system operations (mkdir, cp, Read) and network-enabled CLI tools (gh for GitHub repository creation).
Sanitization: No explicit sanitization, escaping, or validation logic is described for the arguments before they are used in shell contexts or interpolated into the new CLAUDE.md file.
[DATA_EXFILTRATION]: The procedure involves reading ~/.claude/CLAUDE.md to extract environment and identity facts (OS, locale, timezone, user identity). While intended for personalization, this represents access to potentially sensitive local configuration files which are then incorporated into the new workspace and potentially pushed to a remote repository via the gh repo create --push command.

new-workspace