Skill

mcporter

skill:spinabot/brigade#mcporter

Use the mcporter CLI to list, configure, auth, and call MCP servers/tools directly (HTTP or stdio), including ad-hoc servers, config edits, and CLI/type generation.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:23 UTC at 4c2a18f

findings

medium

highest severity

threat classes

1,586

files scanned

8/8

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/mcporter:skills/mcporter/SKILL.md:16:SUPPLY

Security findings 1

Supply chain

mediumContextual riskmedium confidence

The skill's frontmatter declares an automatic prerequisite install of the npm package 'mcporter' with no version pin, so the CLI code fetched at install time is mutable; the install itself is necessary for the declared wrapper purpose, but the missing pin is an undeclared supply-chain exposure.

skills/mcporter/SKILL.md:16

package: mcporter

vector:metadata

Counter-argument considered

The strongest case against: the install is openly declared in the same frontmatter, but declaration does not neutralize supply risk, and the pinned-official-registry carve-out requires a pin that is absent (no version or hash anywhere in the install object). The install block names package mcporter with no version constraint and drives a concrete install-then-execute chain via the required binary, so the mutable-supply claim stands as a contextual risk.

Open questions 1

What the analysis could not settle from the code alone.

Residue: the body documents `mcporter daemon start|status|stop|restart` (line 48), a background-daemon lifecycle not named in the declared purpose (list, configure, auth, call, config edits, CLI/type generation); adjudicate whether this is covered by 'use the mcporter CLI' or is an undeclared capability.

Persistence

Coverage gaps 1

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

scripts/assets/brigade-favicon.ico