serena-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow for these scripts/tools reads outsider-authored free text from the local project workspace (e.g., app.json and other source files) into the LLM context via LSP/file-content ingestion; this includes arbitrary user-provided code/comments/JSON that the operating user did not author (outsider content), which is then surfaced as readable text to the agent/LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill code downloads and installs runtime language-server binaries at runtime (for example https://github.com/clangd/clangd/releases/download/19.1.2/clangd-linux-19.1.2.zip and https://marketplace.visualstudio.com/_apis/public/gallery/publishers/ms-dynamics-smb/vsextensions/al/latest/vspackage), then extracts and executes them as language server processes, so these URLs are runtime external dependencies that fetch and run remote code.