The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it is designed to inspect and process data from a target directory to configure Docker environments.
Ingestion points: The skill inspects user-controlled target directories to resolve workspace workloads (SKILL.md).
Boundary markers: The instructions explicitly mandate isolation as part of the contract and forbid silent execution on the host system if the sandbox is unavailable (SKILL.md).
Capability inventory: The skill manages Docker container lifecycles, mounts projects, and publishes network ports (SKILL.md).
Sanitization: The instructions require verification of services and the use of approved, persistent authentication volumes rather than direct credential injection into images or arguments (SKILL.md).
[DATA_EXFILTRATION]: The instructions include defensive measures to prevent data exposure by strictly forbidding the copying of a user's real authentication directory, embedding credentials in images, or passing secrets through command-line arguments.
[COMMAND_EXECUTION]: While the skill manages process execution, it includes a security requirement that host-mode changes require explicit authorization, maintaining a clear boundary between the sandbox and the host machine.

docker-sandbox