Mcporter 1.0.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:17 AM UTC
• Version: 1.0.0

Overview

The skill is not deceptive, but it is a broad MCP control tool that can call arbitrary remote or stdio servers, run local commands, alter auth/config, start a daemon, and install an unpinned npm package.

Install only if you need a general-purpose MCP operator. Use trusted MCP endpoints, avoid sending secrets to untrusted servers, inspect any command used with --stdio, confirm before create/update/delete tool calls, and prefer a sandboxed or least-privileged environment with a reviewed pinned mcporter version where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6
• Finding: Unpinned npm Dependency Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, line 6 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"📦","requires":{"bins":["mcporter"]},"install":[{"id":"node","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter (node)"}]}} ``` ### Technical Analysis The skill declares installation of the npm package `mcporter` by package name without specifying an exact version, lockfile, or integrity hash. Consequently, the artifact installed during skill setup is determined by the package registry at installation time rather than by the reviewed skill contents. npm packages can execute lifecycle scripts during installation and subsequently run with the permissions of the user operating the agent. If the package registry account, release pipeline, or upstream package is compromised, a malicious future version could execute code even though this skill file remains unchanged. The project contains no bundled implementation or dependency lockfile that would allow the installed code to be verified as part of this audit. No evidence in the reviewed files establishes that the current upstream package is malicious. The finding concerns the unsafe, mutable dependency installation mechanism. ### Attack Path 1. An attacker compromises the upstream `mcporter` npm publisher account, package release process, or another component of its distribution chain. 2. The attacker publishes a malicious version under the same package name. 3. A system installs this skill's required binary using the unversioned package declaration. 4. The package manager resolves the dependency to the attacker-controlled release. 5. Malicious code executes through an npm installation lifecycle script or when the installed `mcporter` binary is invoked. 6. The payload operates with the permissions and environmental access of the user or a ...[truncated 717 chars]
• Remediation: ## Remediation Suggestions - Pin `mcporter` to a specific, reviewed version rather than resolving an unspecified release. - Record and enforce the package's integrity digest through an appropriate lockfile or package-manager integrity mechanism. - Disable npm lifecycle scripts during installation where operationally feasible, and explicitly review any scripts before allowing them. - Retrieve packages only from an approved HTTPS registry with controlled configuration and provenance verification. - Verify package signatures or npm provenance attestations when available. - Scan the pinned package and its complete transitive dependency tree before deployment. - Prefer bundling or vendoring a reviewed artifact when reproducible package verification cannot be enforced. - Run installation and execution in a sandboxed, least-privileged environment without unnecessary secrets, filesystem access, or network permissions. - Establish an update process in which version changes require security review before the pinned dependency is advanced.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly advertises direct HTTP calls, stdio execution, authentication flows, and configuration edits, but provides no safety guidance about network egress, executing local commands, or modifying local state. In an agent-skill context, omission of these warnings can lead users or downstream agents to invoke side-effecting operations without understanding the security consequences.

External Transmission

Medium

• Category: Data Exfiltration

Content

Call tools
- Selector: `mcporter call linear.list_issues team=ENG limit:5`
- Function syntax: `mcporter call "linear.create_issue(title: \"Bug\")"`
- Full URL: `mcporter call https://api.example.com/mcp.fetch url:https://example.com`
- Stdio: `mcporter call --stdio "bun run ./server.ts" scrape url=https://example.com`
- JSON payload: `mcporter call <server.tool> --args '{"limit":5}'`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The remote URL example demonstrates calling an external MCP endpoint and passing a URL parameter, but does not disclose that request data may be sent to third-party services. This is risky in an agent setting because users may unknowingly expose sensitive prompts, tokens, or document contents to external systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The stdio example shows execution of a local command (`bun run ./server.ts`) without any warning that this launches arbitrary local code. In a skill consumed by an automated agent, this can normalize unsafe local process execution and increase the risk of running untrusted scripts or binaries.

Static analysis

No suspicious patterns detected.