claude-peers

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can be injected via the broker’s message routing: mcp-server/server.ts calls check_messages → /message-history and /poll-messages, then places m.text (which originates from other peers/CLI via /send-message) into the agent’s LLM context as tool output text and (for Claude Code) as a notifications/claude/channel payload.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly recommends bypassing Codex's macOS sandbox via the "--dangerously-bypass-approvals-and-sandbox" / "danger-full-access" flags and includes commands to kill peers/broker and interact with launchd, which encourage bypassing security controls and modifying system state.