mcporter
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's metadata initiates the installation of the 'mcporter' package from the Node Package Manager (NPM).
- [COMMAND_EXECUTION]: The skill utilizes the 'mcporter call --stdio' command, which allows for the execution of local binaries or scripts (e.g., 'bun run ./server.ts') to facilitate communication with local MCP servers.
- [DATA_EXFILTRATION]: The tool is capable of performing network requests to external URLs and manages sensitive authentication tokens using the 'mcporter auth' command.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting data from external MCP servers.
- Ingestion points: The agent processes content returned from external tool calls.
- Capability inventory: The skill has access to subprocess execution, network operations, and file-system modifications for configuration.
- Boundary markers: There are no explicit instructions or delimiters used to isolate or ignore embedded instructions within tool outputs.
- Sanitization: The documentation does not specify any validation or filtering mechanisms for data received from remote sources.
Audit Metadata