The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The run_command tool (implemented in tools/extended/cmd_tools.py) executes arbitrary strings via subprocess.run with shell=True. This allows an attacker to execute any shell command on the host system if they can influence the command string passed to the tool.
[REMOTE_CODE_EXECUTION] (HIGH): The run_script tool (implemented in tools/extended/cmd_tools.py) allows for the execution of arbitrary Python or Bash scripts located on the local filesystem. When combined with the skill's ability to modify files, this creates a pathway for persistent and complex code execution.
[DATA_EXFILTRATION] (MEDIUM): The run_command and read_config tools can be used to access sensitive local files (such as SSH keys, cloud credentials, or environment variables) and transmit them to external servers using common network utilities like curl or wget.
[EXTERNAL_DOWNLOADS] (MEDIUM): The skill relies on serena-agent, which is an external dependency from an untrusted organization. This package has not been verified and represents a supply-chain risk.
[PROMPT_INJECTION] (LOW): This skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted data from project files via symbol and file search tools (ingestion points in tools/cli/symbol.py and tools/cli/file.py). Because the skill possesses high-privilege capabilities like arbitrary command execution and file modification (capability inventory in tools/extended/cmd_tools.py and tools/cli/symbol.py), malicious instructions embedded in the analyzed code could potentially trigger dangerous actions. No explicit sanitization or boundary markers were observed in the wrapper code.

serena