daytona-chrome-cdp

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill deliberately launches Chromium with --no-sandbox and --remote-debugging-address=0.0.0.0 (exposing the Chrome DevTools Protocol remotely) and then obtains/exposes the CDP URL — this enables remote code execution and full browser access (cookies, tokens, pages) and is therefore a high-risk backdoor/data-exfiltration vector if reachable by untrusted parties.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow launches a first-party Chromium instance and uses browser tools (e.g., browser_navigate) with a caller-provided DEN_WEB_URL, so the runtime ingestion of outsider-authored free text depends on the specific URL the agent is instructed to navigate to.