ida-reverse
Fail
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: HIGHPERSISTENCEREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill includes a script 'scripts/install-autostart.ps1' that registers a Windows Scheduled Task named 'reverse-skill-ida-mcp' which is configured to execute every minute to ensure the background server remains running.
- [REMOTE_CODE_EXECUTION]: Instructions in 'LOCAL-SETUP.md' and 'SKILL.md' direct the user to install the 'ida-pro-mcp' package directly from a community GitHub repository (mrexodia/ida-pro-mcp) via 'pip install', which executes remote setup scripts on the local machine.
- [DYNAMIC_EXECUTION]: The tool 'idapro_py_eval(code)' allows for the execution of arbitrary, unvalidated Python code strings within the context of the IDA Pro process.
- [COMMAND_EXECUTION]: The skill heavily utilizes PowerShell scripts such as 'start.ps1', 'open.ps1', and 'watchdog.ps1' to perform system-level operations, manage background jobs, and interact with files in sensitive locations like 'C:\Windows\System32'.
Recommendations
- AI detected serious security threats
Audit Metadata