The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructs the agent to mount the sensitive host directory ~/.claude into the devcontainer environment (- ~/.claude:/root/.claude). This directory contains the agent's internal history, conversation transcripts, and memory, making this sensitive information accessible to any code or user within the containerized environment.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface for indirect prompt injection by ingesting and acting upon untrusted project files without sanitization or safety boundaries.
Ingestion points: The agent is directed to read external files including .buildkite/docker/compose.yml, config/database.yml, .ruby-version, and Gemfile (SKILL.md, Step 1).
Boundary markers: Absent. The instructions do not provide delimiters or warnings to treat these files as untrusted content.
Capability inventory: The skill provides the agent with the ability to write Docker and Compose configuration files and execute shell commands through the docker compose interface (SKILL.md, Steps 2-4 and Teardown sections).
Sanitization: Absent. Extracted data from the project files is interpolated directly into generated configurations and potential command executions without validation or escaping.

wk-devcontainer