The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to pull and run a Docker image CoderLuii/HolyClaude:latest from an unverified third-party account on Docker Hub. It also suggests cloning a GitHub repository https://github.com/CoderLuii/HolyClaude.git to build the environment locally.
[PRIVILEGE_ESCALATION]: The provided Docker Compose configuration includes `security_opt:
seccomp:unconfined`. This instruction disables the default Docker seccomp profile, which is a security feature that restricts the system calls a container can make to the host kernel. Disabling it significantly increases the attack surface and potential for container escape vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The workstation environment is designed to process untrusted data from project files and web browsing via its bundled tools (Claude Code, Chromium, etc.), creating a large attack surface for indirect prompt injection.
Ingestion points: Project files mounted at /workspace and web content accessed via Playwright/Chromium.
Boundary markers: None implemented within the skill instructions for the data being processed.
Capability inventory: The environment provides full shell access (bash), network operations (curl), file system access, and multiple AI CLIs with execution capabilities.
Sanitization: There is no evidence of sanitization or filtering for external content processed by the integrated AI tools.

holyclaude-ai-workstation