Gate MCP Installer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:30 AM UTC
• Version: 2026.3.4-1

Overview

The skill is a straightforward Gate MCP installer, with the main risk being an unpinned global npm install that users should review before running.

Before installing, understand that this will add or update a global mcporter npm package and write Gate MCP configuration in your home environment. Prefer a pinned, reviewed mcporter version when possible, avoid running the installer with sudo or administrator privileges, and expect connectivity to https://api.gatemcp.ai/mcp for Gate MCP use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install-gate-mcp.sh:29

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: scripts/install-gate-mcp.sh, lines 29-43
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Step 2: Install mcporter
echo "[Step 2/4] Installing mcporter CLI..."
if command -v mcporter &> /dev/null; then
    echo -e "${YELLOW}⚠ mcporter is already installed ($(mcporter --version))${NC}"
    read -p "Do you want to reinstall/update? (y/N): " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        echo "Updating mcporter..."
        npm i -g mcporter
    fi
else
    echo "Installing mcporter globally..."
    npm i -g mcporter
fi

The same unsafe installation pattern is recommended in SKILL.md lines 32-36, README.md lines 84-86, and references/scenarios.md lines 66-70. SKILL.md also recommends npx mcporter --version at line 36, which can download and execute the package when it is not already available locally.

Technical Analysis

The installer requests mcporter by package name without an exact version, lockfile, or integrity verification. Consequently, each installation resolves whatever package release the configured npm registry currently identifies as current. The installed artifact can therefore change after this skill has been audited.

npm package installation may execute package lifecycle scripts. A compromised package publisher account, malicious future release, registry compromise, dependency compromise, or unsafe registry configuration could therefore result in arbitrary code execution during installation. Global installation also places the package in a shared executable location and exposes future invocations of mcporter to the selected package implementation.

The documentation's npx mcporter --version recommendation creates a related execution path: depending on the local npm/npx version and configuration, npx may retrieve and run a missing package rather than merely inspect an already verified instal ...[truncated 1704 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mcporter to a reviewed exact version, for example:

   bash

   MCPORTER_VERSION="X.Y.Z"
   npm install --global --save-exact "mcporter@${MCPORTER_VERSION}"
   

2. Verify the expected registry before installation and reject untrusted registry overrides:

   bash

   EXPECTED_REGISTRY="https://registry.npmjs.org/"
   test "$(npm config get registry)" = "$EXPECTED_REGISTRY" || {
       echo "Unexpected npm registry"
       exit 1
   }
   

3. Validate the downloaded package using a reviewed integrity digest or a controlled lockfile. Where practical, download the package artifact first, verify its cryptographic digest, and install only the verified artifact.

4. Prefer a project-local dependency governed by package-lock.json and installed with npm ci instead of modifying the global tool environment.

5. Review package lifecycle scripts and use --ignore-scripts if mcporter does not legitimately require them. Test functionality before making this the default because some packages rely on installation scripts.

6. Replace npx mcporter --version with a check of a previously installed, version-pinned binary. If npx must be used for validation, use npx --no-install mcporter --version so that the check fails rather than downloading code.

7. Update SKILL.md, README.md, and references/scenarios.md to use the same pinned and verified installation procedure.

8. Advise users not to execute the installer as root or through sudo; use the least-privileged account and a user-owned npm installation directory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs users to run a local install script and later perform a global npm install without any warning that these actions modify the system and may execute code from local files or external package sources. In a one-click installer context, this reduces user scrutiny and increases the risk of unintended privileged changes or supply-chain compromise if the script or package is tampered with.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs use of npx mcporter --version without pinning a specific package version, which can fetch and execute whatever version is currently published. In an installer/troubleshooting skill that encourages command execution on the user's machine, this creates a supply-chain risk: a compromised or malicious newly published package version could be run during verification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

# Step 3: Configure Gate MCP
echo "[Step 3/4] Configuring Gate MCP server..."
GATE_URL="https://api.gatemcp.ai/mcp"

# Check if already configured
if mcporter config get gate &> /dev/null; then

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

# Step 3: Configure Gate MCP
echo "[Step 3/4] Configuring Gate MCP server..."
GATE_URL="https://api.gatemcp.ai/mcp"

# Check if already configured
if mcporter config get gate &> /dev/null; then

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/install-gate-mcp.sh (reported line 53)May include surrounding context.

sh

# Step 3: Configure Gate MCP
echo "[Step 3/4] Configuring Gate MCP server..."
GATE_URL="https://api.gatemcp.ai/mcp"

# Check if already configured
if mcporter config get gate &> /dev/null; then

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The examples section demonstrates interaction exclusively in Chinese, which can amount to a language/locale preference being imposed by the skill documentation. There is no opt-in, alternative language guidance, or explanation that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documentation says connection issues should be checked against fulltrust.link, but the actual configuration commands in the same file use https://api.gatemcp.ai/mcp as the Gate MCP endpoint. This is an active contradiction in the skill's own instructions and can mislead users during setup and troubleshooting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-facing examples are exclusively in Chinese, which implies a specific language expectation for interacting with the installed skill. The file does not offer an alternative language option or explain that the skill is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.