daytona-chrome-cdp
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill launches Chromium with the flag '--remote-debugging-address=0.0.0.0'. This binds the Chrome DevTools Protocol (CDP) to all available network interfaces on the host sandbox, potentially allowing unauthorized network access to the browser session and any sensitive data within it.
- [PRIVILEGE_ESCALATION]: The launch command uses the '--no-sandbox' flag for Chromium. This disables the browser's primary security boundary that isolates web content from the underlying host system, increasing the risk if the browser visits a malicious site.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with arbitrary external web content using tools like 'browser_snapshot' and 'browser_navigate'. This creates an attack surface where malicious content on a webpage could influence or hijack the agent's behavior.
- Ingestion points: 'browser_snapshot' (SKILL.md) reads rendered page content and metadata into the agent's context.
- Boundary markers: None identified. The instructions do not specify the use of delimiters or warnings to ignore instructions embedded in the snapshots.
- Capability inventory: The agent has command execution capabilities via 'daytona exec' (SKILL.md).
- Sanitization: None identified. The skill does not describe any filtering or validation of the content retrieved from the browser.
Audit Metadata