The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Exposure of sensitive host directories
The skill's templates for devcontainer.json and docker-compose.yml include bind mounts for the host's ~/.claude directory. This folder contains sensitive CLI configuration, command history, and session data for the Claude CLI.
The configuration allows for a broad mount of the parent directory (../..), which exposes the entire folder hierarchy above the project to the containerized environment.
[PRIVILEGE_ESCALATION]: Privileged execution environment
The generated devcontainer.json specifies "remoteUser": "root", which grants processes within the container full administrative privileges.
The skill requires making the generated setup.sh executable, facilitating the execution of custom scripts within this privileged context.
[DYNAMIC_EXECUTION]: Script generation and runtime execution
The skill generates a setup.sh script and a Dockerfile at runtime, which are subsequently executed during the container build and post-creation phases.
[INDIRECT_PROMPT_INJECTION]: Unsanitized input in configuration templates
The skill interpolates user-supplied strings directly into configuration files and shell scripts without validation or escaping.
Ingestion points: User-provided project names, port labels, and monorepo paths gathered in SKILL.md.
Boundary markers: None implemented in the file templates to isolate user data from executable commands.
Capability inventory: Filesystem write access to .devcontainer/ and shell command execution via postCreateCommand.
Sanitization: No evidence of input sanitization or verification before interpolation into sensitive files like setup.sh and Dockerfile.

devcontainer-setup