iai-mcp-memory-server
Warn
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to download and execute setup code from an external repository.
- Evidence:
git clone https://github.com/CodeAbra/iai-mcp.gitfollowed bybash scripts/install.shin the Installation section. - [COMMAND_EXECUTION]: The installation process modifies system configuration for persistence and updates environment variables.
- Evidence: Registers a background daemon via
launchdon macOS. - Evidence: Modifies
~/.zshrcor~/.bashrcto update thePATHenvironment variable. - [COMMAND_EXECUTION]: Installs shell scripts that trigger automatically during assistant sessions.
- Evidence: Hooks installed to
~/.claude/hooks/includeiai-mcp-turn-capture.shandiai-mcp-session-recall.sh. - [DATA_EXFILTRATION]: Contains instructions and examples for sending local memory data to external servers.
- Evidence: Pattern 4 demonstrates using
curlto POST transcript data tohttps://my-backup.example.com/sync. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted user/agent interaction data for future injection into prompts.
- Ingestion points: Conversations captured via
~/.claude/hooks/to session buffers. - Boundary markers: No evidence of delimiters or instructions to ignore embedded commands in recalled memories.
- Capability inventory: Capability to execute shell commands and shell hooks (SKILL.md).
- Sanitization: No evidence of validation or filtering for recalled context.
Audit Metadata