devcontainer-setup
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Grants the container
NET_ADMINcapability to support network isolation viaiptablesandipset. - [EXTERNAL_DOWNLOADS]: Fetches official devcontainer features from the GitHub Container Registry.
- [EXTERNAL_DOWNLOADS]: Installs Claude Code plugins from trusted organizations (Anthropic) and reputable security vendors (Trail of Bits).
- [COMMAND_EXECUTION]: Generates and executes post-installation shell and Python scripts (
post_install.py,install.sh) to automate environment configuration. - [PROMPT_INJECTION]: The skill processes project-controlled metadata which presents an indirect prompt injection surface.
- Ingestion points: Reads metadata from
package.json,pyproject.toml,Cargo.toml, andgo.mod. - Boundary markers: Absent; the skill does not wrap untrusted project data in delimiters.
- Capability inventory: The skill can write and execute Dockerfiles, Python scripts, and shell scripts.
- Sanitization: Absent; project-sourced strings (like project names) are interpolated into scripts and configurations without explicit validation.
Audit Metadata