The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill requires the user to clone and execute code from an unverified third-party GitHub repository (github.com/louislva/claude-peers-mcp). This involves running bun install and executing TypeScript files directly, which can lead to arbitrary code execution on the host machine.
[PRIVILEGE_ESCALATION]: The installation instructions explicitly direct the user to run the agent with the --dangerously-skip-permissions flag. This flag disables the primary security mechanism of the agent (human-in-the-loop confirmation for tool use), allowing the agent to perform potentially destructive actions without user oversight.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vector for indirect prompt injection by allowing instances to receive messages from other peers.
Ingestion points: Messages arrive via the send_message tool and are pushed to the agent's context via the claude/channel protocol.
Boundary markers: There are no boundary markers or instructions to ignore embedded commands within the incoming messages.
Capability inventory: The host agent (Claude Code) has full access to the filesystem and terminal execution.
Sanitization: There is no evidence of sanitization for incoming message content, meaning a malicious peer could potentially send instructions that the receiving agent might execute.
[DATA_EXFILTRATION]: If an OPENAI_API_KEY is configured, the skill automatically generates and sends project summaries to OpenAI. These summaries include sensitive information such as working directories, git branches, recent commits, and modified file names.
[PERSISTENCE]: The skill instructs the user to modify shell configuration files (~/.bashrc or ~/.zshrc) to create persistent aliases. Additionally, the MCP server is registered with a --scope user flag, ensuring it is loaded in every future session of the agent.

claude-peers-mcp-inter-instance-messaging