daytona-electron-test

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs placing API keys verbatim into commands and UI inputs (e.g., setting KEY=sk-proj-... in a daytona exec command and filling password inputs), which requires the agent to handle and emit secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s required workflow includes connecting the app to third‑party LLM providers (see "Connect OpenAI through the UI" and the "Prerequisites: API key for real LLM sessions" / "Injecting API keys" sections) and explicitly instructs the agent to run sessions and read the model output via the UI ("Check response" using document.body.innerText), so untrusted remote model responses can be ingested and could materially influence subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs "git fetch origin && git checkout && pnpm install" inside the Daytona sandbox, which fetches and then installs/executes code from the repo configured as origin (the remote git repository URL fetched at runtime), so that remote repository URL is a runtime external dependency that results in executing fetched code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs creating and modifying sandboxes, installing packages, killing/restarting system processes, writing config files, and explicitly recommends disabling Electron's sandbox (ELECTRON_DISABLE_SANDBOX or --no-sandbox) and making sandboxes public, which collectively modify the machine state and bypass security protections.