devcontainer-setup
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's reference material includes an example of a remote code execution pattern (curl piped to bash) using the domain example.com. This is provided strictly for educational purposes to demonstrate shell pipe safety (set -o pipefail) and does not represent an actual threat vector.
- [EXTERNAL_DOWNLOADS]: The skill configures devcontainers to download official features from the GitHub Container Registry (ghcr.io) and uses the uv tool for efficient Python binary management from reputable sources.
- [COMMAND_EXECUTION]: The skill generates scripts and configurations that execute standard development commands (e.g., npm install, cargo build, uv sync) within the isolated devcontainer environment as part of its core functionality.
- [PROMPT_INJECTION]: The skill ingests data from local project files such as package.json and pyproject.toml to determine project names and language stacks. Potential risks from malicious project metadata are mitigated by instructions to slugify inputs (converting to lowercase and replacing spaces with hyphens) before use.
Audit Metadata