mcporter
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the --stdio flag within the call command, allowing the agent to execute local scripts or binaries (e.g., 'mcporter call --stdio bun run server.ts'). This is a standard feature for MCP communication but provides a mechanism for subprocess execution.
- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection. 1. Ingestion points: The agent processes data returned from external MCP servers or URLs. 2. Boundary markers: The skill does not define delimiters to distinguish between tool data and instructions. 3. Capability inventory: Includes the ability to execute shell commands via --stdio and modify configurations. 4. Sanitization: No sanitization of tool output is described.
- [EXTERNAL_DOWNLOADS]: The skill installs the mcporter package from the NPM registry during initialization. While this is the vendor's own package, it represents an external dependency.
Audit Metadata