🌐 Deploy HTML content to EdgeOne Pages

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:54 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims by deploying supplied content publicly, but it relies on an unpinned npm tool executed via npx, which deserves review before use.

Install only if you are comfortable running the current npm release of mcporter and publishing the provided content to a public URL. Do not deploy secrets, credentials, private documents, or internal data through this skill; a pinned package version would make the install path easier to trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Package Download and Automatic Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–17 and 29–30
Vulnerability Type: Unpinned third-party dependency executed from a remote package registry
Risk Level: Medium

Vulnerable Code:

yaml

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "mcporter",
      "bins": ["mcporter"],
      "label": "Install mcporter (node)",
    },
  ],

shell

npx -y mcporter call mcp-on-edge.edgeone.app/mcp-server.deploy-html value="<html>Content</html>"
npx -y mcporter call mcp-on-edge.edgeone.app/mcp-server.deploy-html value="$(cat index.html)"

Technical Analysis

The Skill declares mcporter without an exact version and instructs users to invoke it through npx -y. When the package is not already available locally, npx can retrieve the currently resolved package release from the configured registry and execute it automatically. The -y option suppresses the interactive installation confirmation.

No lockfile, integrity hash, exact package version, or other mechanism constrains the downloaded artifact to the version reviewed by the Skill author. Consequently, the code executed during a future invocation can differ from the code that existed when this Skill was audited. Exploitation would require compromise of the package, its publisher account, the registry or dependency-resolution path, or publication of a malicious future release.

Attack Path

1. An attacker compromises the mcporter package publication channel or causes a malicious release to resolve under that package name.
2. A user or Agent follows the documented npx -y mcporter deployment command.
3. npx downloads the unconstrained package release without requesting confirmation.
4. Package installation hooks or runtime code execute with the permissions and environment of the invoking account.
5. The malicious code can access resources available to that accou ...[truncated 914 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mcporter to a specific, reviewed version in both installation metadata and invocation commands, such as mcporter@<exact-version>.
• Manage the dependency through a committed lockfile and use deterministic installation, such as npm ci, rather than resolving the latest release at execution time.
• Verify package integrity through registry integrity metadata, approved hashes, provenance attestations, or signature verification.
• Avoid using npx -y to automatically download and execute an unconstrained package during deployment.
• Retrieve dependencies from a trusted, access-controlled registry or approved internal mirror.
• Review the pinned package, its transitive dependencies, and lifecycle scripts before approval; repeat this review before version upgrades.
• Run the deployment utility in a least-privilege sandbox with minimal filesystem, environment-variable, credential, and network access.
• Warn users explicitly that deployed input is sent to a third-party service and exposed through a public URL.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells users to provide arbitrary HTML or text for deployment and notes that a public URL will be returned, but it does not clearly warn that the submitted content becomes publicly accessible. This can lead users to accidentally publish secrets, private documents, tokens, or internal data to the internet.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill invokes npx -y mcporter without pinning a specific package version, which means execution depends on whatever version is current at install time. If the package is updated maliciously or a breaking/unsafe release is published, users of the skill could execute unreviewed code during deployment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command also runs mcporter via unpinned npx, creating a supply-chain risk because the executed package version is not fixed. Anyone using the example may unknowingly run a newly published or compromised version of the tool.

Content

No source excerpt is available for this finding.