devcontainer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited devcontainer (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Do NOT pause for confirmation. Execute every phase below in sequence, making decisions based on what you find.
============================================================ PHASE 0 — INPUT ============================================================
$ARGUMENTS may contain:
--compose — force Docker Compose-based setup even for single-service projects--minimal — generate a lightweight config without extras (no extensions, no features)mcr.microsoft.com/devcontainers/python:3.12)If no arguments, auto-detect everything and generate a full-featured config.
============================================================ PHASE 1 — STACK DETECTION ============================================================
Detect the project stack by scanning for manifest files:
Language & Runtime:
package.json → Node.js (read engines.node for version, default 20)tsconfig.json → TypeScript projectpyproject.toml / requirements.txt / Pipfile → Python (read requires-python, default 3.12)go.mod → Go (read go directive for version)Cargo.toml → Rustpubspec.yaml → Flutter/DartGemfile → Ruby (read .ruby-version for version)Services:
docker-compose.yml / docker-compose.*.yml → existing services to integrateprisma/schema.prisma → read provider for database type (postgresql, mysql, sqlite, mongodb).env.example → scan for DATABASE_URL, REDIS_URL, MONGO_URI patternspyproject.toml → check for sqlalchemy, django with database backendsPackage Manager:
package-lock.json (npm), yarn.lock (yarn), pnpm-lock.yaml (pnpm), bun.lockb (bun)poetry.lock (poetry), Pipfile.lock (pipenv), uv.lock (uv)Record: language, version, framework, package manager, required services (database, cache, queue).
============================================================ PHASE 2 — GENERATE DEVCONTAINER CONFIG ============================================================
Create .devcontainer/devcontainer.json:
Base Image Selection (use Microsoft Dev Container images):
mcr.microsoft.com/devcontainers/javascript-node:{version}mcr.microsoft.com/devcontainers/typescript-node:{version}mcr.microsoft.com/devcontainers/python:{version}mcr.microsoft.com/devcontainers/go:{version}mcr.microsoft.com/devcontainers/rust:latestmcr.microsoft.com/devcontainers/ruby:{version}mcr.microsoft.com/devcontainers/universal:2Dev Container Features (add based on detected stack):
ghcr.io/devcontainers/features/docker-in-docker:2 (if Dockerfile exists)ghcr.io/devcontainers/features/github-cli:1ghcr.io/devcontainers/features/common-utils:2ghcr.io/devcontainers/features/node:1ghcr.io/devcontainers/features/python:1ghcr.io/devcontainers/features/aws-cli:1 (if AWS config detected)VS Code Extensions (match detected stack):
dbaeumer.vscode-eslint, esbenp.prettier-vscode, ms-vscode.vscode-typescript-nextms-python.python, ms-python.vscode-pylance, charliermarsh.ruffgolang.gorust-lang.rust-analyzerDart-Code.dart-code, Dart-Code.fluttereamodio.gitlens, EditorConfig.EditorConfig, usernamehw.errorlensmtxr.sqltools + appropriate driver extensionms-azuretools.vscode-dockerPort Forwarding (detect from project):
docker-compose.yml for exposed ports.env.example for PORT, API_PORT, DB_PORT variablesPost-Create Command:
npm installpnpm installyarn installpip install -r requirements.txtpoetry installuv syncgo mod downloadcargo fetchflutter pub get&& npx prisma migrate dev or equivalent============================================================ PHASE 3 — MULTI-SERVICE SETUP ============================================================
If the project requires services (database, cache, queue) OR --compose was passed:
Create .devcontainer/docker-compose.yml:
services:
app:
build:
context: ..
dockerfile: .devcontainer/Dockerfile
volumes:
- ..:/workspaces/${localWorkspaceFolderBasename}:cached
command: sleep infinityAdd detected services:
postgres:16-alpine with POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB, volume for data persistencemysql:8 with equivalent configmongo:7 with init script volumeredis:7-alpine with persistence configrabbitmq:3-management-alpine with management UI portCreate .devcontainer/Dockerfile using the detected base image with any additional tooling.
Update devcontainer.json to reference docker-compose:
{
"dockerComposeFile": "docker-compose.yml",
"service": "app",
"workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}"
}If no services are needed, use the simpler image or build approach directly in devcontainer.json.
============================================================ PHASE 4 — CODESPACES COMPATIBILITY ============================================================
Ensure GitHub Codespaces compatibility:
"hostRequirements" if the project needs more than the default 2-core machine:"cpus": 4"cpus": 4, "memory": "8gb""codespaces" section if needed for prebuild configuration${localWorkspaceFolderBasename} not hardcoded names.devcontainer/devcontainer.json to .gitattributes as linguist-generated if the file does not existVerify the generated config is valid JSON (no trailing commas, proper escaping).
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing, validate the output was produced correctly:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
Print a summary of all generated files:
## Dev Container Setup Complete
### Files Created
- .devcontainer/devcontainer.json — main configuration
- .devcontainer/docker-compose.yml — multi-service orchestration (if applicable)
- .devcontainer/Dockerfile — custom image (if applicable)
### Detected Stack
- Language: {language} {version}
- Framework: {framework}
- Package Manager: {pm}
- Services: {postgresql, redis, etc. or "none"}
### Included Extensions
- {list of VS Code extensions}
### Port Forwarding
- {port}: {service description}
### Post-Create Setup
- {command that runs after container creation}============================================================ NEXT STEPS ============================================================
/env-setup to verify all dependencies and services are working/git-hooks to set up pre-commit hooks inside the container============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /devcontainer — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
vscode/devcontainers — use mcr.microsoft.com/devcontainers).env files or Codespaces secrets.devcontainer/devcontainer.json without reading it first and preserving custom settingsroot as the container user unless absolutely necessary — prefer the default dev container user~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.