daytona-flow-validator
Warn
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using daytona exec to manage the sandbox environment, including using sudo to install system packages.
- [REMOTE_CODE_EXECUTION]: The skill uses browser_eval to execute arbitrary JavaScript within browser or Electron renderer processes for application state interaction and UI automation.
- [EXTERNAL_DOWNLOADS]: The skill performs system updates via apt-get and retrieves artifacts using webfetch, involving connections to external repositories.
- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection due to the ingestion of untrusted application data and logs. 1. Ingestion points: browser_snapshot, innerText, and system logs (e.g., electron.log). 2. Boundary markers: No delimiters or warnings are present. 3. Capability inventory: daytona exec, sudo, and browser_eval. 4. Sanitization: No content filtering or validation is described.
Audit Metadata