skills/fikriaf/agentos/mcporter/Gen Agent Trust Hub

mcporter

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the mcporter CLI to execute shell commands, specifically for launching MCP servers via the --stdio flag (e.g., mcporter list --stdio "npx -y @modelcontextprotocol/server-filesystem"). It also includes features for generating executable CLI wrappers.
  • [EXTERNAL_DOWNLOADS]: The instructions direct the agent to fetch and run code from the NPM registry using npx for both the primary mcporter tool and secondary MCP server packages.
  • [DATA_EXFILTRATION]: The skill facilitates sending data to external endpoints when calling remote HTTP-based MCP servers (e.g., mcporter call https://api.example.com/mcp.fetch). It also allows importing configuration files from local paths.
  • [PROMPT_INJECTION]: As a tool-agnostic interface, the skill is susceptible to indirect prompt injection where instructions hidden in the output of external MCP tools could influence the agent's logic.
  • Ingestion points: Data returned from mcporter call tool invocations in SKILL.md.
  • Boundary markers: No specific delimiters or safety warnings are implemented in the skill instructions.
  • Capability inventory: Includes subprocess execution via --stdio, network communication via HTTP tool calls, and configuration management.
  • Sanitization: No documented sanitization or validation of external tool outputs is provided.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 07:45 PM
Security Audit — agent-trust-hub — mcporter