The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains a hardcoded password OpenWorkDemo123! for the demo user alex@acme.test within the authentication validation instructions in SKILL.md.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, including local scripts (.devcontainer/test-server-on-daytona.sh) and remote execution strings via the daytona exec command, which involve piping complex shell logic into remote sandboxes.
[DATA_EXFILTRATION]: The skill performs network operations using curl to interact with remote services defined by environment variables ($DEN_API_URL, $DEN_WEB_URL), creating a risk for unintended data transmission.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates untrusted environment variables and branch names into shell commands and browser scripts without sanitization or boundary markers. Mandatory Evidence Chain: 1. Ingestion points: $SERVER_SANDBOX, $DEN_API_URL, $DEN_WEB_URL, $TOKEN, $ORG_ID, $ORG_SLUG, $ORG_NAME, and git branch names via git rev-parse. 2. Boundary markers: Absent. 3. Capability inventory: Remote shell execution (daytona exec), network interaction (curl), and browser storage manipulation (localStorage). 4. Sanitization: Absent.

daytona-cloud-instance