mcporter
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
mcporterpackage from the official Node.js package registry (NPM). - [COMMAND_EXECUTION]: The skill instructs the agent to execute various
mcporterCLI commands to list, call, and configure MCP tools. - [COMMAND_EXECUTION]: It supports the execution of arbitrary shell commands through the
--stdioflag to run local MCP servers (e.g.,mcporter call --stdio "bun run ./server.ts"). - [COMMAND_EXECUTION]: The skill manages a background daemon process using the
mcporter daemoncommands. - [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting data from external MCP tools and servers (Category 8). Maliciously crafted responses from these servers could attempt to influence the agent's behavior.
- Ingestion points: Tools called via
mcporter callfrom remote servers or local scripts. - Boundary markers: No explicit delimiters or warnings are used for tool outputs in the provided instructions.
- Capability inventory: Subprocess execution via
--stdio, network operations via HTTP tool calls, and credential management viaauthandconfigcommands. - Sanitization: No sanitization or validation of external tool output is documented in the skill.
Audit Metadata