skills/zlliang/skills/mcporter/Gen Agent Trust Hub

mcporter

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill guides the agent to use the mcporter CLI and includes examples of running arbitrary local scripts using the --stdio flag, such as bun run ./server.ts.
  • [EXTERNAL_DOWNLOADS]: The skill connects to and retrieves information from remote MCP servers via URLs (e.g., https://mcp.linear.app/mcp).
  • [DATA_EXFILTRATION]: The documentation recommends passing secrets like LINEAR_API_KEY via environment variables. While this is a standard practice, the mcporter call command transmits data to external MCP server endpoints.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing data from external MCP servers.
  • Ingestion points: Results and metadata from mcporter list and mcporter call (SKILL.md).
  • Boundary markers: None identified.
  • Capability inventory: Shell command execution and remote network requests.
  • Sanitization: No explicit sanitization of external server output is documented.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 12:06 PM
Security Audit — agent-trust-hub — mcporter