The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary shell commands defined in a Containerfile via the RUN directive. The scripts/containerfile.py script uses subprocess.run(cmd, shell=True) to process these instructions, providing a direct mechanism for system-level changes.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its primary ingestion point, the Containerfile.
Ingestion points: The skill parses a Containerfile (typically located in the project root or specified via CLI) which may contain malicious instructions if the file originates from an untrusted source or a compromised repository.
Boundary markers: None. The parser processes directives like RUN and FETCH directly without isolation or safety boundaries.
Capability inventory: The skill possesses powerful capabilities including arbitrary shell execution (RUN), network file downloads (FETCH), environment variable modification (ENV), and the ability to overwrite system-level directories by extracting tarballs to the root filesystem (tar -xzf ... -C /).
Sanitization: While shlex.split is used for FETCH arguments, the content of RUN directives is passed directly to the shell for execution.
[EXTERNAL_DOWNLOADS]: The skill downloads logic and environment layers from external sources.
The boot.sh and boot-ccotw.sh scripts bootstrap the skill by fetching the latest version from the author's GitHub repository (oaustegard/claude-skills).
The FETCH directive in the Containerfile allows downloading files or GitHub repositories into the container environment.
Cached layers are retrieved from GitHub Releases on a user-specified or default repository (oaustegard/claude-container-layers).
[REMOTE_CODE_EXECUTION]: The bootstrap process in boot.sh uses a curl | tar pattern to download and extract the skill's Python logic from a remote repository, which is then immediately available for execution via python3 -m scripts.cli.

container-layer