Security audit

Mcporter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small, disclosed mcporter command guide, but it enables broad MCP calls, local stdio commands, auth/config changes, daemon use, and an unpinned npm install that users should handle carefully.

Install this only if you intend to let the agent use mcporter. Treat MCP URLs, stdio server commands, auth/config changes, and daemon commands as sensitive: use trusted endpoints, avoid passing secrets unless needed, review local commands before running them, and prefer a pinned or otherwise controlled mcporter package version.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Third-Party Node.js Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium **Vulnerable Code**: ```yaml metadata: {"clawdbot":{"emoji":"📦","requires":{"bins":["mcporter"]},"install":[{"id":"node","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter (node)"}]}} ``` ### Technical Analysis The installation metadata requests the `mcporter` Node.js registry package without specifying an exact version or package integrity hash. Consequently, the package content installed in the future may differ from the content reviewed when this Skill was published. This creates a supply-chain risk because package resolution depends on mutable external registry state. If the package publisher account, registry entry, or transitive dependency chain is compromised, a malicious release could be selected during installation. Node.js packages may execute lifecycle scripts during installation, allowing compromised package content to run commands on the host. ### Attack Path 1. An attacker compromises the `mcporter` package publisher, its registry account, or a dependency in its supply chain. 2. The attacker publishes a malicious version that contains harmful runtime behavior or an installation lifecycle script. 3. A user installs the Skill dependency using the unversioned package declaration. 4. The package manager resolves the attacker-controlled release because no exact reviewed version or integrity constraint is enforced. 5. Malicious package code executes during installation or when the `mcporter` command is invoked. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the account performing the installation or running `mcporter`. Depending on those privileges, the attacker could access local files and credentials available to that account, alter project or user configuration, invoke network ...[truncated 170 chars]
Remediation: ## Remediation Suggestions - Pin `mcporter` to an exact, reviewed version rather than allowing unconstrained registry resolution. - Enforce package integrity verification using a trusted lockfile or a cryptographic integrity hash. - Obtain the package only from an explicitly trusted registry and protect registry configuration from dependency-confusion attacks. - Review direct and transitive dependencies before updating the pinned version. - Disable package lifecycle scripts during installation where operationally feasible, or perform installation in an isolated environment. - Run the installed CLI with least privilege and restrict its filesystem, credential, and network access. - Establish a controlled update process in which new versions are reviewed and tested before the version pin and integrity data are changed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

External Transmission

Medium

Category: Data Exfiltration
Content: Call tools - Selector: `mcporter call linear.list_issues team=ENG limit:5` - Function syntax: `mcporter call "linear.create_issue(title: \"Bug\")"` - Full URL: `mcporter call https://api.example.com/mcp.fetch url:https://example.com` - Stdio: `mcporter call --stdio "bun run ./server.ts" scrape url=https://example.com` - JSON payload: `mcporter call <server.tool> --args '{"limit":5}'`
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill encourages calling arbitrary remote MCP endpoints by URL and executing ad-hoc stdio commands such as `bun run ./server.ts`, but does not warn that these actions can contact untrusted services or launch local processes. In an agent setting, this increases the risk of SSRF-like outbound access, exfiltration, or execution of attacker-controlled local command lines.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill explicitly exposes `auth` and `config` operations, including add/remove/import/login/logout, but provides no warning that these commands can modify local configuration or alter authentication state. In an agent context, that omission can lead users or higher-level orchestrators to invoke state-changing commands without understanding the persistence and security implications.

Static analysis

No suspicious patterns detected.