The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill utilizes sudo to perform system-level operations required for container management and security enforcement.
Evidence: sudo systemctl start docker in SKILL.md to initiate the Docker service on Linux hosts.
Evidence: postStartCommand in devcontainer.json executes the firewall script with sudo privileges.
Evidence: The Dockerfile modifies /etc/sudoers.d/ to grant the container user passwordless sudo access specifically for the firewall initialization script.
[REMOTE_CODE_EXECUTION]: The Docker configuration downloads and immediately executes a shell script from an external source.
Evidence: references/dockerfile.md contains a RUN command that fetches zsh-in-docker.sh from github.com/deluan/zsh-in-docker and pipes it to sh.
[EXTERNAL_DOWNLOADS]: The skill fetches software packages and network configuration data from various external sources.
Evidence: Downloads the git-delta binary from github.com/dandavison/delta during the Docker build process.
Evidence: The firewall script in references/init-firewall.sh.md fetches IP metadata from api.github.com/meta to configure allowed network ranges.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context markers to execute discovery commands when the skill is loaded by the agent.
Evidence: Uses !pwd, `!`ls -la .devcontainer/devcontainer.json ..., and !docker info ...`` in SKILL.md to assess the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill creates an environment designed for autonomous operation with suppressed permissions, which increases the impact if the agent processes malicious instructions in project files.
Ingestion points: The entire project directory is mounted to /workspace inside the container.
Boundary markers: None present; the skill encourages the use of --dangerously-skip-permissions which bypasses internal LLM safety prompts for tool use.
Capability inventory: The agent gains full command execution and file system access within the container, along with persistent storage via Docker volumes.
Sanitization: No data sanitization is performed; however, the skill implements a network firewall (default-deny) to mitigate the risk of data exfiltration.
[COMMAND_EXECUTION]: Performs file system operations to manage vendor-specific plugins.
Evidence: Copies files from node_modules/@jgamaraalv/ts-dev-kit/ to the project's .claude/ directory to ensure availability within the isolated container environment.

yolo