mcporter

The skill explicitly demonstrates the ability to execute arbitrary commands using `mcporter call --stdio`, allowing for direct execution of system commands or scripts with attacker-controlled input.

mcporter call --stdio "bun run ./server.ts"

The `mcporter generate-cli --command <url>` command allows fetching and processing code from an arbitrary external URL, which could be used to introduce malicious code or configurations.

mcporter generate-cli --command <url>

Commands like `mcporter auth` and `mcporter config add|import|login` can manage authentication and configuration, potentially allowing a compromised `mcporter` tool to harvest credentials or inject persistent malicious settings.

mcporter auth <server | url>, mcporter config list|get|add|remove|import|login|logout

The `mcporter daemon start` command can launch a background process, which, if the `mcporter` binary is compromised, could be used to establish persistence for malicious activities.

mcporter daemon start|status|stop|restart