The Agent Skills Directory

[OBFUSCATION]: The skill utilizes powershell -EncodedCommand to execute Base64-encoded script blocks. While the skill notes this is to resolve shell quoting issues, this technique effectively hides the command logic from plain-text static analysis.
[PRIVILEGE_ESCALATION]: The skill creates scheduled tasks that run with SYSTEM user privileges (/ru SYSTEM), enabling administrative actions and access to protected system certificate stores.
[PERSISTENCE]: The skill establishes persistence within the sandbox by creating a Windows Scheduled Task (schtasks) configured to trigger automatically on system startup (/sc onstart).
[COMMAND_EXECUTION]: The skill executes arbitrary commands on the target sandbox using daytona exec, which runs as nt authority\system in session 0.
[DYNAMIC_EXECUTION]: The skill dynamically generates a Windows command batch file (C:\ow\start-openwork-tls-repro.cmd) at runtime and subsequently schedules it for execution.
[EXTERNAL_DOWNLOADS]: The skill fetches application builds and PowerShell scripts from the vendor's GitHub repositories (github.com/different-ai/openwork).
[REMOTE_CODE_EXECUTION]: The skill downloads PowerShell scripts and ZIP archives containing application builds from remote sources and executes them directly on the target system.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by downloading and executing content from external GitHub releases and raw source files.
Ingestion points: ZIP archives and scripts downloaded into C:\ow\ from GitHub releases.
Boundary markers: None identified.
Capability inventory: File system writes, SYSTEM-level command execution, network downloads, and scheduled task creation.
Sanitization: No validation or sanitization is performed on the downloaded executable content before execution.

daytona-windows-cert