local-llm-router
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to install the 'serena' package via pip and provides a command to execute remote code from 'github.com/oraios/serena' using uvx.\n- [COMMAND_EXECUTION]: The 'SerenaMCP' class within 'SKILL.md' utilizes 'subprocess.Popen' to initiate the Serena MCP server process using the 'serena' command.\n- [DYNAMIC_EXECUTION]: The skill includes logic to parse assistant responses for code blocks and apply them as file edits through the 'apply_edit' method of the Serena MCP client.\n- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it incorporates external tool context and user queries into LLM prompts without sanitization or explicit boundary markers.\n
- Ingestion points: Untrusted data enters the flow through the 'handle_code_request' and 'route' methods in 'SKILL.md'.\n
- Boundary markers: The 'build_enriched_query' function fails to use delimiters or ignore-instructions warnings for interpolated context.\n
- Capability inventory: The skill can spawn subprocesses, perform local network operations, and modify local files.\n
- Sanitization: No validation or escaping is applied to the semantic metadata retrieved from the Serena tool.
Audit Metadata