mcporter
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'mcporter' package from the public Node package registry (NPM) as a core dependency for its operations.
- [COMMAND_EXECUTION]: The skill instructions demonstrate the use of the '--stdio' flag (e.g., 'mcporter call --stdio "bun run ./server.ts"'), which allows for the execution of arbitrary shell commands to interface with local MCP servers.
- [DYNAMIC_EXECUTION]: The 'generate-cli' and 'emit-ts' commands facilitate the generation of code and CLI tools based on external definitions, which may lead to the execution of generated scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external MCP servers, creating a vulnerability surface where malicious tool outputs could influence the agent.
- Ingestion points: Outputs from 'mcporter call' commands fetching data from remote or local MCP servers (SKILL.md).
- Boundary markers: None; instructions do not provide delimiters or instructions to ignore embedded commands in tool results.
- Capability inventory: The skill has access to network requests, local command execution via stdio, and configuration file modification.
- Sanitization: There is no evidence of sanitization or validation of the data returned by the MCP servers before it is processed by the agent.
Audit Metadata