mcporter
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of the
mcporterCLI to execute local commands via stdio when interacting with MCP servers (e.g.,mcporter call --stdio "bun run ./server.ts"). This is a core feature of the tool for running local MCP server instances. - [EXTERNAL_DOWNLOADS]: The skill's metadata specifies the installation of the
mcporterpackage from the Node.js package registry (NPM). - [DATA_EXFILTRATION]: The tool includes functionality for managing authentication credentials (
mcporter auth) and configuration files (mcporter config), and it performs network requests to remote MCP servers as part of its primary function. - [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from external MCP servers (via
mcporter call), which presents a standard attack surface where external content could potentially contain instructions intended to influence the agent's behavior.
Audit Metadata