ClawHub
Back to skill

Security audit

Mcporter Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent with its stated MCP CLI purpose, but it gives an agent broad authority to authenticate, edit configuration, run stdio commands, start a daemon, and call arbitrary MCP endpoints without clear built-in scoping or consent boundaries.

Install only if you intend to give the agent a general-purpose MCP administration CLI. Treat auth, config changes, daemon actions, stdio commands, and arbitrary URL calls as sensitive operations that should be explicitly requested and reviewed. Prefer a pinned, reviewed mcporter package version before using this in higher-trust environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding
Unpinned npm Dependency Installation Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 6 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"📦","requires":{"bins":["mcporter"]},"install":[{"id":"node","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter (node)"}]}} ``` ### Technical Analysis The installation metadata identifies the npm package as `mcporter` without specifying an exact version or cryptographic integrity value. Consequently, the package manager may resolve and install whichever release is associated with the applicable npm distribution tag at installation time. This makes the reviewed skill definition non-reproducible: the dependency installed in the future may differ from the dependency available when the skill was audited. If the package, maintainer account, publication credentials, or package registry were compromised, a malicious release could be distributed without requiring any modification to this repository. The project contains only `SKILL.md` and `_meta.json`; no embedded executable scripts or direct malicious code were identified. There is also no evidence in the reviewed files that the current `mcporter` package is malicious. The finding concerns the unsafe dependency-resolution policy. ### Attack Path 1. An attacker compromises the `mcporter` npm package, a maintainer account, or the relevant registry publication process. 2. The attacker publishes a malicious version and causes it to be selected by the package's default or applicable distribution tag. 3. A user or agent installs this skill's required binary using the installation metadata. 4. Because no version is pinned, the installer resolves the attacker-controlled release. 5. Malicious package lifecycle scripts may execute during installation, or malicious behavior may run when the agent later invokes the installed `mcporter` binary. 6. The payload operates with ...[truncated 720 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin `mcporter` to a reviewed, exact version rather than relying on an unversioned package reference. 2. Where supported by the skill installer, record and verify the package artifact's cryptographic integrity hash. 3. Use a lockfile or equivalent immutable dependency manifest for reproducible installation. 4. Review the selected package version, including its lifecycle scripts and transitive dependencies, before approving it. 5. Configure automated dependency monitoring, but require explicit review before updating the pinned version. 6. Run installation and CLI execution as an unprivileged user in a restricted environment with only the filesystem, credential, and network access necessary for the task. 7. Disable npm lifecycle scripts during installation when they are not required, then separately verify that the installed CLI functions correctly. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill advertises broad capabilities to list, configure, authenticate to, and call MCP servers directly, but it does not define clear trigger constraints or usage boundaries. In an agent setting, this can enable overbroad invocation for sensitive actions such as remote calls, auth flows, and config changes without sufficient user confirmation or narrowing context.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documentation lacks an explicit warning that it can modify configuration, initiate authentication, execute stdio-based commands, and make direct calls to remote MCP servers or URLs. Without user-facing warnings, an agent may use these capabilities in ways that surprise users and increase the risk of credential exposure, unwanted network access, or local command execution.

External Transmission

Medium
Category
Data Exfiltration
Content
Call tools
- Selector: `mcporter call linear.list_issues team=ENG limit:5`
- Function syntax: `mcporter call "linear.create_issue(title: \"Bug\")"`
- Full URL: `mcporter call https://api.example.com/mcp.fetch url:https://example.com`
- Stdio: `mcporter call --stdio "bun run ./server.ts" scrape url=https://example.com`
- JSON payload: `mcporter call <server.tool> --args '{"limit":5}'`
Confidence
86% confidence
Finding
The examples show the skill can call arbitrary remote URLs and pass URLs as arguments, which creates a direct external transmission capability. In the context of an agent skill, this is dangerous because it could be used to exfiltrate data, contact untrusted endpoints, or bridge local/agent context into remote services if invoked without strict controls.

Static analysis

No suspicious patterns detected.