The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads and executes an installation script from https://claude.ai/install.sh via bash. While targeting a domain associated with the tool's vendor, this pattern represents remote code execution.
[REMOTE_CODE_EXECUTION]: The 'Automatic skill sync' feature uses npx to fetch and install agent skills from external sources, such as GitHub repositories. This execution happens unattended during every container startup, potentially running code from non-vendor sources like mattpocock/skills or user-defined repositories.
[INDIRECT_PROMPT_INJECTION]: The skill synchronization feature introduces a vulnerability by importing external natural language instructions that can influence agent behavior without human oversight.
Ingestion points: External skill files are downloaded into the ~/.claude/skills directory via templates/post-start-block.sh.
Boundary markers: Absent; the skill explicitly states the process is unattended with no per-skill review step.
Capability inventory: Ingested skills are utilized by Claude Code, which has the ability to execute shell commands, modify the file system, and access the network.
Sanitization: None; there is no validation or filtering of the content within the downloaded skills before they are integrated into the agent's environment.
[COMMAND_EXECUTION]: The skill configures a 'claude-yolo' alias in ~/.bashrc using --permission-mode auto and --remote-control. This configuration bypasses standard manual confirmation prompts for the agent's actions, significantly reducing human oversight of its operations within the container.
[COMMAND_EXECUTION]: Employs rm -rf in templates/post-start-block.sh to clear the skill cache directory (/home/vscode/.claude/skills/*) before each synchronization. While flagged as a potentially destructive command, it is used here for standard cache management.
[PERSISTENCE]: The skill establishes persistence for potentially unsafe configurations by modifying post-start.sh to re-sync external code on every boot and updating ~/.bashrc to maintain high-autonomy aliases across sessions.

setup-claude-devcontainer