mcporter
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill setup involves installing the
mcporterpackage from the public Node.js registry. - [COMMAND_EXECUTION]: The
mcporterCLI is capable of executing shell commands to start local MCP servers via the--stdiointerface. - [DATA_EXFILTRATION]: The skill can perform network requests to arbitrary URLs and manage authentication tokens for MCP tool interaction.
- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection from untrusted MCP servers.
- Ingestion points: Responses from tools called via the
mcporterCLI (SKILL.md). - Boundary markers: No delimiters or safety instructions are defined to separate tool output from instructions.
- Capability inventory: Shell command execution through stdio and network requests through HTTP tool calls (SKILL.md).
- Sanitization: No sanitization or validation of tool outputs is present in the skill definition.
Audit Metadata