mcporter

SUSPICIOUS: the skill is broadly consistent with an MCP client/management tool, and the upstream CLI provenance appears same-project and npm/GitHub-aligned rather than an unknown payload. The main risk is scope: it lets an agent authenticate to arbitrary MCP servers, invoke arbitrary remote tools, execute local stdio commands, and generate files, which is powerful and medium-risk even though it matches the stated purpose.