Mcporter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:13 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it gives an agent broad MCP, auth, config, local command, and daemon capabilities without enough scoping or safety guidance.

Install only if you want an agent to operate mcporter with broad MCP authority. Before use, confirm any OAuth login, config change, daemon start, remote MCP URL, and --stdio command, and avoid sending secrets or running scripts unless the server or local code is trusted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party npm Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Complete Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"📦","requires":{"bins":["mcporter"]},"install":[{"id":"node","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter (node)"}]}} ``` ### Technical Analysis The installation metadata identifies the `mcporter` npm package only by name. It does not pin an audited version, provide an integrity hash, include a lockfile, or specify a verified package source. Consequently, installation can resolve to package content that differs from the content reviewed during this audit. This creates a software supply-chain risk. If the package publisher account or registry is compromised, or if a future package release becomes malicious, the installation process could retrieve attacker-controlled code. npm packages may also define lifecycle scripts that execute during installation with the permissions of the user performing the installation. The audit found no evidence that the current Skill intentionally selects a typosquatted package or contains a malicious payload. The vulnerability is the absence of controls that ensure installations remain tied to an audited artifact. ### Attack Path 1. An attacker compromises the upstream `mcporter` package, its publisher account, or the package distribution channel. 2. The attacker publishes a malicious release under the expected package name. 3. A user or agent installs the Skill dependency using the unversioned package declaration. 4. The package manager resolves and downloads the attacker-controlled release. 5. Malicious package code or npm lifecycle scripts execute in the installation environment. 6. The payload acts with the installing user's permissions and may compromise files, credentials, configuration, or subsequent CLI operations. ### Impact Assessment ...[truncated 589 chars]
• Remediation: ## Remediation Suggestions - Pin `mcporter` to an exact, reviewed version rather than resolving an unspecified release. - Use a lockfile with registry-provided integrity metadata where the Skill packaging system supports it. - Document and enforce the canonical package registry and verified upstream publisher. - Validate the downloaded package against a trusted checksum or signed provenance before installation. - Review package contents and transitive dependencies whenever the pinned version is updated. - Disable npm lifecycle scripts during installation unless they are explicitly required and have been audited. - Perform installation and execution in a least-privilege, isolated environment with restricted access to credentials and sensitive files. - Consider generating and retaining a software bill of materials for the approved dependency version and its transitive dependency tree.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly supports authentication, configuration modification, and direct calls to remote MCP servers, but it provides no warning that these actions may transmit data off-host or persistently alter local configuration. In an agent setting, this omission can lead users or downstream automation to trigger network access or credential/config changes without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented `--stdio` example runs an arbitrary local command (`bun run ./server.ts`) but does not warn that this results in local code execution. In an agent workflow, examples are often copied or adapted directly, so presenting command execution without a caution materially increases the risk of unsafe local process launch.

External Transmission

Medium

• Category: Data Exfiltration

Content

Call tools
- Selector: `mcporter call linear.list_issues team=ENG limit:5`
- Function syntax: `mcporter call "linear.create_issue(title: \"Bug\")"`
- Full URL: `mcporter call https://api.example.com/mcp.fetch url:https://example.com`
- Stdio: `mcporter call --stdio "bun run ./server.ts" scrape url=https://example.com`
- JSON payload: `mcporter call <server.tool> --args '{"limit":5}'`

• Confidence: 84% confidence
• Finding: The example demonstrates direct invocation of a remote URL-based MCP endpoint and passing a URL argument, which can cause external network communication and possible transmission of sensitive prompts, data, or metadata. Although presented as documentation, the skill context encourages direct remote calls and does not disclose privacy, trust, or destination-validation considerations.

Static analysis

No suspicious patterns detected.