The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates and executes several scripts at runtime, including a post_install.py script and an install.sh CLI helper. These scripts are created based on inferred project data and then executed as part of the container lifecycle.
[COMMAND_EXECUTION]: The skill configures the postCreateCommand in the devcontainer to execute various shell commands such as uv sync, npm ci, cargo build, and go mod download based on detected project languages.
[PRIVILEGE_ESCALATION]: The generated configuration requests the NET_ADMIN capability for the container to facilitate the use of network isolation tools like iptables and ipset. This provides the container with high-level network configuration privileges.
[EXTERNAL_DOWNLOADS]: The skill fetches devcontainer features from ghcr.io/devcontainers/features/rust:1 and ghcr.io/devcontainers/features/go:1. It also references plugins from anthropics/skills and trailofbits/skills. These are well-known or trusted services.
[DATA_EXFILTRATION]: The skill performs project reconnaissance by reading sensitive configuration files such as package.json, pyproject.toml, Cargo.toml, and go.mod to extract project names and version requirements.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it ingests untrusted data from project configuration files (e.g., package.json names) and interpolates them into generated scripts and Dockerfiles. While instructions specify 'slugifying' the input, a malicious project file could attempt to inject commands if sanitization is bypassed.
Ingestion points: Project configuration files (package.json, pyproject.toml, Cargo.toml, go.mod).
Boundary markers: The instructions mandate a 'slugification' process (lowercase, hyphenate) for interpolated names, which acts as a boundary marker.
Capability inventory: The skill has the capability to write files to the local filesystem (.devcontainer/ directory) and execute arbitrary shell commands via the postCreateCommand and generated scripts.
Sanitization: The skill includes explicit instructions for slugification (lowercase, replace spaces/underscores with hyphens) to normalize external data.

devcontainer-setup