The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses daytona exec to run shell commands inside the sandbox environment. This includes starting background services using nohup, managing directories, and executing local shell scripts such as test-on-daytona.sh and stop-daytona-recording.sh.
[DATA_EXFILTRATION]: The core purpose of the skill is to host sandbox files (screenshots, recordings, and an index page) on a public URL. It uses python3 -m http.server to serve directories (/workspace/proof-frames or /daytona-artifacts) and daytona preview-url to generate a publicly accessible link. While this is the intended functionality, it creates a mechanism for exposing sandbox contents to the internet.
[DYNAMIC_EXECUTION]: The skill instructions require the agent to dynamically generate a browseable index.html file at runtime, incorporating metadata like branch names, commits, and sandbox identifiers into the HTML structure.
[INDIRECT_PROMPT_INJECTION]: The skill interpolates external, potentially untrusted data—such as branch names, commit hashes, and user-defined recording names—directly into shell commands (e.g., bash .devcontainer/test-on-daytona.sh [branch-or-commit]). This presents a vulnerability surface for command injection if the agent processes malicious input names without sanitization.

record-a-demo