claude-peers-mcp-inter-instance-messaging
Fail
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads and executes code from a third-party GitHub repository (github.com/louislva/claude-peers-mcp.git) which is not a verified or recognized vendor source.
- [REMOTE_CODE_EXECUTION]: The installation process involves cloning a remote repository and running its contents as an MCP server with bun, providing a path for arbitrary code execution if the repository is modified or compromised.
- [COMMAND_EXECUTION]: Explicitly instructs the user to run Claude Code with the --dangerously-skip-permissions flag. This flag disables user confirmation for tool execution, significantly increasing the risk of autonomous malicious actions by the agent.
- [DATA_EXFILTRATION]: The list_peers tool exposes sensitive environment data including local file paths (cwd), repository names, and current git branches across different terminal sessions, facilitating reconnaissance across isolated project directories.
- [PERSISTENCE]: Encourages adding aliases to shell profile files (~/.bashrc, ~/.zshrc) that permanently configure the terminal environment to run Claude with safety permissions disabled.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from other instances via send_message and list_peers (SKILL.md). Analysis of the evidence chain shows: (1) Ingestion points: Peer messages and summaries; (2) Boundary markers: Absent; (3) Capability inventory: Claude Code shell access; (4) Sanitization: Absent. This enables one session to potentially control another via malicious injected instructions.
Recommendations
- AI detected serious security threats
Audit Metadata