av/harbor is a command-line tool and companion app that uses Docker Compose to start a connected local stack of language-model backends, user interfaces, and supporting AI services. People use it to run services such as Ollama, llama.cpp, vLLM, Open WebUI, search, voice, and image-generation tools without configuring their connections manually, while the catalogue provides agent workflows for operating Harbor.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add av/harbor --skill harbor-daytonagit clone --depth 1 https://github.com/av/harborWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/av/harbor/harbor-daytona)<a href="https://agentmods.dev/skills/av/harbor/harbor-daytona"><img src="https://agentmods.dev/badge/skills/av/harbor/harbor-daytona/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/av/harbor/harbor-daytona"><img src="https://agentmods.dev/badge/skills/av/harbor/harbor-daytona.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 13 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Supply Chain · line 41 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Supply Chain · line 91 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Supply Chain · line 149 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Supply Chain · line 220 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Supply Chain · line 227 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Tool Misuse · line 274 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 274 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- medium Data Exfiltration · line 41 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 133 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 145 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 149 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 238 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 257 Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.Fix: Remove unnecessary filesystem scanning. If file access is needed, use explicit, scoped paths. Avoid reading ~/.ssh, ~/.aws, or credential directories.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.03051 |
| Opus 5 | $0.00034 | $0.01525 |
| Sonnet 5 | $0.00013 | $0.00610 |
| Haiku 4.5 | $0.00007 | $0.00305 |
Grade A, and why
harbor-daytona scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 305 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Harbor Daytona: Computer Use
Daytona is a self-hosted sandbox platform running inside Harbor. Each sandbox provides an isolated Linux environment with a full XFCE4 desktop (Xvfb + x11vnc + noVNC) controllable via REST API — screenshot, mouse, keyboard, process management.
Quick Start
# Start the Daytona platform (14 containers)
harbor up daytona
# Verify it's healthy
harbor ps | grep daytona
Dashboard: http://localhost:$(harbor config get daytona.host_port)/dashboard
Default credentials: [email protected] / password (via Dex OIDC; login is by email)
Auth
All API calls use the admin API key as a Bearer token:
API_KEY=$(harbor config get daytona.admin_api_key)
AUTH="Authorization: Bearer $API_KEY"
API="http://localhost:$(harbor config get daytona.host_port)"
Default key: harbor-daytona-admin-key
Sandbox Lifecycle
Create a sandbox
curl -s -X POST "$API/api/sandbox" -H "$AUTH" -H "Content-Type: application/json" \
-d '{
"snapshot": "daytonaio/sandbox:v0.185.0-amd64",
"user": "daytona",
"cpu": 2,
"memory": 4,
"disk": 10,
"autoStopInterval": 30
}'
The response includes the sandbox id — use it in all subsequent calls. The sandbox starts in "state": "creating" and transitions to "started" (typically 20-30 seconds).
CreateSandbox fields: name, snapshot, user, env (object), labels (object), public (bool), cpu, gpu, memory (GB), disk (GB), autoStopInterval (minutes, 0=disabled), autoArchiveInterval, autoDeleteInterval (-1=disabled), target ("us"), volumes, linkedSandbox.
Poll until started
STATE=""
while [ "$STATE" != "started" ]; do
STATE=$(curl -s "$API/api/sandbox/$SANDBOX_ID" -H "$AUTH" | python3 -c "import sys,json; print(json.load(sys.stdin)['state'])")
sleep 2
done
Other lifecycle operations
# List sandboxes
curl -s "$API/api/sandbox" -H "$AUTH"
# Get sandbox details
curl -s "$API/api/sandbox/$SANDBOX_ID" -H "$AUTH"
# Stop / start / delete
curl -s -X POST "$API/api/sandbox/$SANDBOX_ID/stop" -H "$AUTH"
curl -s -X POST "$API/api/sandbox/$SANDBOX_ID/start" -H "$AUTH"
curl -s -X DELETE "$API/api/sandbox/$SANDBOX_ID" -H "$AUTH"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 305 lines · 67 tokens per session scan E 04b6a78352cf
harbor-daytona is a skill published in the GitHub repository av/harbor (3,209 stars, last pushed yesterday), licensed Apache-2.0. It adds 67 tokens to every session and 3,051 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
web-scrape
Extract structured data from web pages using CSS selectors. Use when the user asks to scrape a website, extract text or links from a page, parse HTML content, get data from a table, read article content, collect image URLs, or pull structured information from any web page. Keywords: scrape, extract, parse, crawl, get…
web-scraper
Browse websites and extract structured information. Use when the user needs data from a web page.
browser
Browser automation via Playwright MCP — navigate pages, click elements, fill forms, take screenshots, extract text, manage tabs, and run JavaScript in the browser. Use when the user asks to open a website, interact with a web page, scrape dynamic content, fill out forms, take a page screenshot, test a web application…
web-access
Use this skill for live web research, webpage fetching, login-state browsing, dynamic pages, social sites, and tasks that need current internet evidence.
webapp-testing
Browser-based UI verification using Playwright. Page Object Model, selector best practices, visual regression, network interception, and MCP integration. Trigger: When writing E2E tests, verifying UI changes, or setting up Playwright.
hugging-face-tool-builder
Use this skill when the user wants to build tool/scripts or achieve a task where using data from the Hugging Face API would help. This is especially useful when chaining or combining API calls or the task will be repeated/automated. This Skill creates a reusable script to fetch, enrich or process data.