The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches code and components from external sources, specifically github.com/oraios/serena and ghcr.io/oraios/serena, to install and run the Serena MCP server.- [REMOTE_CODE_EXECUTION]: Configuration examples for various LLM clients (Claude, Codex, etc.) instruct the use of uvx to download and execute the Serena server package directly from a Git repository at runtime.- [COMMAND_EXECUTION]: The skill includes the execute_shell_command tool, which allows the agent to execute arbitrary commands on the user's system. The documentation acknowledges this risk, advising users to disable the tool in untrusted contexts or use a read-only mode.- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external codebase content and project-specific memories which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Untrusted data enters the agent's context through tools like read_file, find_symbol, and read_memory which retrieve content from the project directory.
Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore instructions embedded within the processed code files.
Capability inventory: The agent possesses high-impact capabilities including arbitrary shell execution (execute_shell_command) and the ability to modify project files (replace_symbol_body, create_text_file).
Sanitization: The skill does not describe any specific sanitization or filtering of the content retrieved from the codebase before it is processed by the agent.

serena-mcp-agent