daytona-windows-cert

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The document explicitly instructs creating and trusting a fake corporate root CA in the Windows machine store and running SYSTEM-level scheduled tasks, which weakens security boundaries and could be abused, though the stated intent is testing.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill downloads and then executes remote scripts at runtime from these URLs — https://github.com/different-ai/openwork/releases/download/${TAG}/$(basename "$ZIP") and https://raw.githubusercontent.com/different-ai/openwork/dev/scripts/support/setup-openwork-tls-repro.ps1 (and the companion openwork-doctor.ps1) — resulting in fetched content being run inside the sandbox.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing a fake corporate CA into the Windows machine store and creating/running scheduled tasks as SYSTEM (modifying Cert:\LocalMachine\Root, hosts, and persistent services), which are privileged, system-wide changes that compromise the machine state.