gen-devcontainer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gen-devcontainer (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Wraps bin/gen-devcontainer.sh. Emits a devcontainer.json; preview- by-default; idempotent on apply.
.devcontainer/directory yet.
nyann (base image tags + extension lists shift with the snapshot_version comment in the file).
devcontainer (use --port 3000 --cpus 4 --memory 8gb).
different concern; devcontainer.json is dev-environment only.
existing file with them; this skill generates fresh, not diagnoses.
works under JetBrains' Dev Containers plugin and devcontainer open (CLI), but flag the broader VS Code-first defaults.
Read StackDescriptor.primary_language from bin/detect-stack.sh:
| StackDescriptor.primary_language | --language |
|---|---|
typescript / javascript | node |
python | python |
go | go |
rust | rust |
dart | dart |
java / kotlin | java |
csharp / dotnet | dotnet |
php | php |
ruby | ruby |
swift | swift |
elixir | elixir |
cpp / c | cpp |
For polyglot monorepos (workspaces[] present), pick the language of the most-important workspace OR ask the user — running multiple devcontainers from a single repo is uncommon and confusing.
Always preview first. Show the rendered JSON; wait for confirmation:
bin/gen-devcontainer.sh --language python --name my-appThen on confirmation:
bin/gen-devcontainer.sh --language python --name my-app \
--target . --applyIf the destination already matches: log "unchanged" and exit. If it differs: print the unified diff to stderr, exit 3, prompt the user before re-running with --force-overwrite.
.devcontainer/devcontainer.json containing:
$schema pointing at the official devcontainer spec$comment tagging the nyann snapshot versionname (display name in 'Open in Container' picker)image (per-language, pinned to a major:minor tag)features (gh CLI, git-lfs, common-utils — version-pinned)customizations.vscode.extensions (per-language pack + gitlens + git-graph)postCreateCommand (per-language dep install — npm ci, uv sync, cargo fetch, etc.)forwardPorts (when --port flag(s) supplied)hostRequirements (when --cpus / --memory / --storage supplied)exist (well-maintained, security-scanned, multi-arch). Vendor images for Dart / Swift / Elixir where no MS variant exists.
major:minor, NOT a digest. Operators whoneed byte-reproducible builds should pin to a digest by hand; the Docker ecosystem of gen-dependency-updater can roll the tag.
gitlens + git-graphbaseline. Conservative pick; extend via --extension.
github-cli:1 + git-lfs:1 + common-utils:2,always with a version pin so floating tags can't quietly re-broadcast.
expected manifest is missing (so the file works in a partially- scaffolded repo). Override with --post-create-command for non- standard package managers (e.g. pnpm rather than npm).
When previewing:
org-internal mirror).
that don't fit their workflow).
--port flags if the user mentioned a dev-server port inthe conversation.
When applying:
intentional if --force-overwrite was used).
gh codespace create invocation if the userasked for Codespaces specifically.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.