daytona-chrome-cdp
Launch and control standalone Chrome in a Daytona sandbox via CDP. Use for web sign-in, OAuth, Den Web setup, browser-only flows, or when the app should not be driven through Electron CDP.
80
100%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
The canonical home for this skill is daytona-chrome-cdp in different-ai/openwork
Security
1 critical severity finding. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The skill deliberately launches Chromium with --no-sandbox and --remote-debugging-address=0.0.0.0 (exposing the Chrome DevTools Protocol remotely) and then obtains/exposes the CDP URL — this enables remote code execution and full browser access (cookies, tokens, pages) and is therefore a high-risk backdoor/data-exfiltration vector if reachable by untrusted parties.
- Repository
- Devin-AXIS/iPolloWork
- Commit
bd5caef
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.