setup-devcontainer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). In the required runtime workflow, all skill synchronization sources are user-selected but then installed by running the provided post-start.sh template locally in the devcontainer (rm -rf .../skills then {{SKILLS_SOURCES_COMMANDS}}), and no path reads outsider-authored free text until those skills’ contents are already fetched/consumed by the trusted Claude Code runtime (not specified here as LLM-ingested free text by this skill’s workflow).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The devcontainer's post-start script runs the injected {{SKILLS_SOURCES_COMMANDS}} on every start (templates/post-start.sh:10) which by default executes npx to fetch external skill repositories (mattpocock/skills and ken-guru/skills) at runtime, pulling remote code that directly controls agent skills/behavior.