ClawHub
Back to skill

Security audit

Mcporter Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent with its stated MCP CLI purpose, but it gives an agent broad authority to authenticate, edit configuration, run stdio commands, start a daemon, and call arbitrary MCP endpoints without clear built-in scoping or consent boundaries.

Install only if you intend to give the agent a general-purpose MCP administration CLI. Treat auth, config changes, daemon actions, stdio commands, and arbitrary URL calls as sensitive operations that should be explicitly requested and reviewed. Prefer a pinned, reviewed mcporter package version before using this in higher-trust environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding

Unpinned npm Dependency Installation Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises broad capabilities to list, configure, authenticate to, and call MCP servers directly, but it does not define clear trigger constraints or usage boundaries. In an agent setting, this can enable overbroad invocation for sensitive actions such as remote calls, auth flows, and config changes without sufficient user confirmation or narrowing context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documentation lacks an explicit warning that it can modify configuration, initiate authentication, execute stdio-based commands, and make direct calls to remote MCP servers or URLs. Without user-facing warnings, an agent may use these capabilities in ways that surprise users and increase the risk of credential exposure, unwanted network access, or local command execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The examples show the skill can call arbitrary remote URLs and pass URLs as arguments, which creates a direct external transmission capability. In the context of an agent skill, this is dangerous because it could be used to exfiltrate data, contact untrusted endpoints, or bridge local/agent context into remote services if invoked without strict controls.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
Call tools
- Selector: `mcporter call linear.list_issues team=ENG limit:5`
- Function syntax: `mcporter call "linear.create_issue(title: \"Bug\")"`
- Full URL: `mcporter call https://api.example.com/mcp.fetch url:https://example.com`
- Stdio: `mcporter call --stdio "bun run ./server.ts" scrape url=https://example.com`
- JSON payload: `mcporter call <server.tool> --args '{"limit":5}'`