The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the mcporter CLI to execute sub-processes. The --stdio flag is particularly risky as it allows for the execution of arbitrary shell command strings (e.g., mcporter list --stdio "npx -y @modelcontextprotocol/server-filesystem").- [EXTERNAL_DOWNLOADS]: The skill documentation requires downloading and installing the mcporter package from the public npm registry.- [REMOTE_CODE_EXECUTION]: Through the use of the --stdio parameter and the generate-cli functionality, the skill can execute or generate executable code based on external or dynamically provided commands.- [DATA_EXFILTRATION]: The skill supports connecting to arbitrary remote MCP servers via HTTP URLs (e.g., mcporter list --http-url https://some-mcp-server.com). This enables the transfer of data from the local environment to external, potentially attacker-controlled servers.- [CREDENTIALS_UNSAFE]: The mcporter auth and mcporter config commands involve managing authentication tokens and sensitive configuration files, which could lead to credential exposure if process logs or terminal outputs are captured.

mcporter