ida-mcp-headless-reverse-engineering

Warn

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The run_script tool allows the AI agent to execute arbitrary Python code (IDAPython) on the host system where IDA Pro is installed. This provides the agent with extensive control over the local environment via the IDA API.
  • [EXTERNAL_DOWNLOADS]: The installation guide directs users to download and install packages from third-party sources, specifically the blacktop GitHub organization via Homebrew, Snap, and Scoop.
  • [DYNAMIC_EXECUTION]: The run_script functionality enables the generation and execution of code at runtime. This includes both inline code strings and execution of external Python files on the host machine.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted binaries and malware samples. This creates a surface where malicious content within the analyzed files (such as strings, function names, or decompiled logic) could influence the agent's behavior. Ingestion points: open_idb, read_bytes, strings, decompile, and search_text in SKILL.md. Boundary markers: Absent. Capability inventory: run_script, open_idb, and full IDA API access in SKILL.md. Sanitization: Absent.
  • [PRIVILEGE_ESCALATION]: Installation procedures for Linux involve sudo commands for Snap packages. Additionally, the configuration requires setting sensitive environment variables such as DYLD_LIBRARY_PATH and IDADIR, which directly influence system library loading and executable behavior.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 16, 2026, 10:44 PM
Security Audit — agent-trust-hub — ida-mcp-headless-reverse-engineering