mcporter
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
mcporterCLI which supports running arbitrary shell commands via the--stdioflag, as shown in the example:mcporter call --stdio "bun run ./server.ts" scrape. This allows the agent to execute local scripts and binaries. - [EXTERNAL_DOWNLOADS]: The skill metadata defines an installation step for the
mcporterNode.js package from a public registry. This introduces a dependency on third-party code that is executed with the agent's privileges. - [DATA_EXFILTRATION]: The
mcporter callcommand allows the agent to make requests to arbitrary URLs (e.g.,mcporter call https://api.example.com/...), which provides a mechanism for sending data to external endpoints. - [CREDENTIALS_UNSAFE]: The tool manages authentication tokens and configuration settings, specifically targeting
./config/mcporter.json. While it provides management commands (mcporter auth,mcporter config), the exposure of these credentials to the agent's environment is a security consideration.
Audit Metadata