The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an untrusted external source (https://github.com/louislva/claude-peers-mcp.git) and execute bun install to fetch third-party dependencies.
[REMOTE_CODE_EXECUTION]: The installation process involves running downloaded TypeScript files (server.ts, cli.ts) as a background service and CLI tool, which allows for the execution of unverified code on the host machine.
[PRIVILEGE_ESCALATION]: The instructions explicitly recommend launching the agent with the --dangerously-skip-permissions flag. This flag disables critical security guardrails, such as user prompts for file and shell access, significantly increasing the risk of unauthorized actions.
[PERSISTENCE]: The skill encourages users to modify shell profiles (~/.bashrc or ~/.zshrc) to add aliases for launching the communication server. It also registers the tool as a global MCP server (claude mcp add --scope user), ensuring it loads automatically in future agent sessions.
[INDIRECT_PROMPT_INJECTION]: The core functionality enables a cross-agent communication channel that is highly susceptible to indirect injection.
Ingestion points: Untrusted data enters the agent context via the send_message and check_messages tools, as well as via instant channel pushes.
Boundary markers: There are no documented boundary markers or instructions to ignore commands within peer messages, meaning an agent may interpret a message from a 'peer' as a direct instruction.
Capability inventory: The receiving agent possesses extensive capabilities, including shell execution and file system access.
Sanitization: No sanitization or validation mechanisms are described for the messages exchanged between instances, allowing one compromised or malicious session to influence or control others.

claude-peers-mcp