Gate MCP Installer

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  2026.3.4-1

Overview

This skill does what it claims: installs and configures Gate MCP, though it changes the user's local toolchain and connects to an external MCP service.

Install only if you trust the mcporter npm package and the Gate MCP endpoint. Expect a global CLI install or update, a home-scoped mcporter config entry, and network calls to the Gate MCP service during verification and later use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill instructs users to run an installer and globally install software (`npm i -g mcporter`) and write persistent configuration (`mcporter config add ... --scope home`) without clearly warning that these actions modify the user's system. In a one-click installer context, that increases the risk of users making trust decisions without understanding persistence, package provenance, or rollback implications.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The scenario instructs the agent to run an installation script and perform a global npm install without any warning, confirmation, or discussion of system-wide changes. In an agent setting, this is risky because it normalizes executing privileged or persistent modifications automatically, which could unexpectedly alter the user's environment or install unreviewed code.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The update/reinstall flow directs a global upgrade to the latest mcporter version without warning that it may overwrite an existing installation, change behavior, or break compatibility. In the context of an automation skill, this increases the chance of unintended toolchain disruption because the agent may perform the change as a default action rather than a reviewed maintenance step.

VirusTotal

65/65 vendors flagged this skill as clean.