mcporter

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs the mcporter package from the official Node.js package registry (NPM).
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute various mcporter CLI commands to list, call, and configure MCP tools.
  • [COMMAND_EXECUTION]: It supports the execution of arbitrary shell commands through the --stdio flag to run local MCP servers (e.g., mcporter call --stdio "bun run ./server.ts").
  • [COMMAND_EXECUTION]: The skill manages a background daemon process using the mcporter daemon commands.
  • [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting data from external MCP tools and servers (Category 8). Maliciously crafted responses from these servers could attempt to influence the agent's behavior.
  • Ingestion points: Tools called via mcporter call from remote servers or local scripts.
  • Boundary markers: No explicit delimiters or warnings are used for tool outputs in the provided instructions.
  • Capability inventory: Subprocess execution via --stdio, network operations via HTTP tool calls, and credential management via auth and config commands.
  • Sanitization: No sanitization or validation of external tool output is documented in the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 09:13 PM
Security Audit — agent-trust-hub — mcporter