mcporter
Warn
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the 'mcporter call --stdio' command, which allows the execution of arbitrary shell commands and local scripts (e.g., 'bun run ./server.ts').- [EXTERNAL_DOWNLOADS]: The skill's metadata specifies the installation of the 'mcporter' package from a Node.js package registry during setup.- [DATA_EXFILTRATION]: The 'mcporter call' command can be used to send data to arbitrary external URLs, creating a potential path for data exfiltration if the agent processes sensitive information.- [INDIRECT_PROMPT_INJECTION]: The skill processes responses from external MCP servers, which constitutes an attack surface for indirect prompt injection.
- Ingestion points: Tool outputs and server schemas retrieved via 'mcporter call' and 'mcporter list' in SKILL.md.
- Boundary markers: No boundary markers or instructions to ignore embedded commands are present.
- Capability inventory: Subprocess execution ('--stdio'), network requests ('call '), and file generation ('generate-cli').
- Sanitization: No sanitization or validation of external tool outputs is defined.
Audit Metadata