Security audit

Uplo Accounting

Security checks for vulnerabilities and agentic risk

Overview

This accounting skill fits its stated UPLO knowledge-search purpose, but it handles sensitive financial data with under-disclosed logging, bulk export, remote directives, and mutable runtime code.

Install only for an approved UPLO tenant with a narrowly scoped token. Treat all searched, exported, and logged accounting content as confidential; avoid using export_org_context or session logging unless your organization has approved retention, redaction, audit, and access controls. Prefer a pinned and reviewed MCP server version instead of the unpinned npx runtime.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: skill.json:24
Finding: Unpinned Third-Party Package Is Automatically Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:10
Finding: Remote Identity Context and Directives Can Influence Agent Behavior Without a Defined Trust Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:44
Finding: Conversation-Derived Data Is Sent to a Remote Service Without Explicit Consent or Redaction Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup instructions require an API key and point users to a remote AGENTDOCS_URL, but the README does not warn that accounting knowledge and documents may be transmitted to an external service for indexing, search, and extraction. Because the skill is explicitly designed for bookkeeping, tax preparation, audit support, and financial statement workpapers, the omission can lead users to send highly sensitive financial data off-platform without understanding the privacy, compliance, and vendor-risk implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises an export_org_context capability that can expose a full organizational context snapshot, but it provides no warning about the sensitivity of the data that may be included or the access controls required before using it. In an accounting-focused skill, organizational context may include financial records, tax documents, workpapers, and other confidential information, so normalizing bulk export without caution materially increases the risk of over-disclosure or misuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is presented as an accounting knowledge search tool, but its documented capabilities include fetching identity context and organizational context export, which materially expand data access beyond simple search. This creates a risk of over-collection or disclosure of sensitive organizational metadata without clear scoping, justification, or user awareness, especially in an accounting context where data is often confidential.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Documenting organizational context export without any warning or handling guidance encourages use of a capability that may expose sensitive internal structures, identities, or business information. In an accounting domain, exported context can amplify the sensitivity of related financial records by making them easier to correlate and misuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The session-end instruction to log conversations introduces a retention capability that is not disclosed in the skill's search-oriented description. Undisclosed logging of accounting-related conversations can capture sensitive financial, tax, or audit information and create privacy, compliance, and data-governance risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs automatic conversation logging without any notice to the user that their interaction may be recorded or stored. In an accounting workflow, users may provide highly sensitive financial and tax information, so silent retention increases privacy, confidentiality, and regulatory exposure.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction to log each conversation creates a built-in retention path for user-supplied accounting content, including potentially sensitive bookkeeping, tax, audit, or financial statement details. Even if intended for operational tracking, storing natural-language summaries and topics can preserve confidential information and increase breach or misuse impact.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description is very broad for a skill that can search bookkeeping records, tax documents, audit files, and export organizational context. Without clear trigger constraints or scoped activation guidance, an agent may invoke this skill in loosely related conversations and expose sensitive financial data beyond user intent. In an accounting context, overbroad activation is more dangerous because the underlying data is likely confidential and regulated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The configuration hard-codes 'DEFAULT_PACKS' to 'accounting', which imposes a default domain/context selection without indicating user choice or documented opt-in. Under natural-language policy review, fixed defaults that constrain language/locale/domain behavior should be justified or made user-selectable when not clearly documented as region- or compliance-specific.
Content: No source excerpt is available for this finding.