Mcporter Cli

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed MCP command-line helper, but it gives broad authority to authenticate, edit configs, call arbitrary MCP endpoints, run stdio commands, and start a daemon without clear user-control boundaries.

Install only if you trust the mcporter Node package and need broad MCP control. Before use, approve the exact server or URL, arguments, auth flow, config change, stdio command, or daemon action, and avoid sending secrets or private data to untrusted MCP endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description is broad enough to match many generic MCP, tool-calling, configuration, authentication, and server-interaction requests. That increases the chance of over-invocation, causing the agent to expose powerful capabilities like arbitrary server calls, config edits, auth flows, and code generation in contexts where narrower scoping would be safer.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal