The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses daytona exec to run shell commands that incorporate variables such as branch names, commit hashes, and recording names (e.g., git checkout feat/my-branch and ffprobe ... /recordings/<name>.mp4). If these values are sourced from untrusted user input without sanitization, it could lead to command injection in the sandbox environment.
[DATA_EXFILTRATION]: The skill instructs the agent to start a Python HTTP server (python3 -m http.server) on port 8090 and generate a public preview URL using daytona preview-url. This mechanism intentionally exposes the contents of the /workspace/proof-frames or /daytona-artifacts directories to the public internet. If sensitive data or credentials are inadvertently placed in these directories, they would be exposed.
[REMOTE_CODE_EXECUTION]: The skill relies on the execution of local shell scripts found within the repository's .devcontainer directory (e.g., test-on-daytona.sh, capture-daytona-screenshot.sh). This assumes the repository contents are trusted, as these scripts are executed with the same privileges as the agent within the sandbox.

daytona-recording-artifacts