mcporter
Warn
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The CLI tool supports executing local scripts and shell commands through the '--stdio' parameter, allowing the agent to launch arbitrary processes. It also features dynamic code generation capabilities ('generate-cli', 'emit-ts') to create CLI tools and TypeScript code at runtime.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from untrusted data sources.\n
- Ingestion points: Data is ingested from local files or remote HTTP servers during server listing and tool calling operations.\n
- Boundary markers: No delimiters or specific instructions are used to isolate untrusted server output within the agent context.\n
- Capability inventory: The mcporter tool possesses capabilities for command execution, local configuration modification, and authentication management.\n
- Sanitization: No evidence of sanitization or validation of data returned by external MCP tools is provided.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates network connections to arbitrary HTTP endpoints specified in server URLs.
Audit Metadata