mcporter
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the agent to use the
mcporterCLI and includes examples of running arbitrary local scripts using the--stdioflag, such asbun run ./server.ts. - [EXTERNAL_DOWNLOADS]: The skill connects to and retrieves information from remote MCP servers via URLs (e.g.,
https://mcp.linear.app/mcp). - [DATA_EXFILTRATION]: The documentation recommends passing secrets like
LINEAR_API_KEYvia environment variables. While this is a standard practice, themcporter callcommand transmits data to external MCP server endpoints. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing data from external MCP servers.
- Ingestion points: Results and metadata from
mcporter listandmcporter call(SKILL.md). - Boundary markers: None identified.
- Capability inventory: Shell command execution and remote network requests.
- Sanitization: No explicit sanitization of external server output is documented.
Audit Metadata