Uplo Accounting

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

This accounting skill fits its stated UPLO knowledge-search purpose, but it handles sensitive financial data with under-disclosed logging, bulk export, remote directives, and mutable runtime code.

Install only for an approved UPLO tenant with a narrowly scoped token. Treat all searched, exported, and logged accounting content as confidential; avoid using export_org_context or session logging unless your organization has approved retention, redaction, audit, and access controls. Prefer a pinned and reviewed MCP server version instead of the unpinned npx runtime.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: skill.json:24
• Finding: Unpinned Third-Party Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `skill.json:24-29` **Additional Location**: `README.md:20-29` **Vulnerability Type**: Supply-chain exposure through an unpinned npm dependency **Risk Level**: Medium ### Vulnerable Code ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], ``` The same unsafe installation pattern is documented in `README.md`: ```json { "mcpServers": { "uplo-accounting": { "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { "AGENTDOCS_URL": "https://your-instance.uplo.ai", "API_KEY": "your-api-key", "DEFAULT_PACKS": "accounting" } } } } ``` ### Technical Analysis The MCP server is launched with `npx -y @agentdocs1/mcp-server` without an exact package version or integrity hash. The `-y` option suppresses installation confirmation, so npm can automatically retrieve and execute whichever package version the registry currently resolves. The reviewed project does not contain the package source, a lockfile, or an integrity record. Consequently, the effective executable payload may change after this Skill has been reviewed. npm lifecycle scripts may also execute during installation. A compromised publisher account, malicious future release, or registry-level supply-chain incident could therefore introduce arbitrary code. The configured `API_KEY` is supplied directly to the downloaded process as an environment variable. A malicious package version could read and exfiltrate that credential, as well as access other resources available to the MCP process. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution pipeline, or a future release of `@agentdocs1/mcp-server`. 2. The attacker publishes a malicious version under the same package name. 3. A user installs or starts the Skill. 4. `npx -y` resolves and downloads the malicious current version without ...[truncated 907 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@agentdocs1/mcp-server` to an exact, reviewed version rather than relying on the latest registry resolution. 2. Use a lockfile and verify the package integrity hash before execution. 3. Prefer a locally installed, reviewed dependency over downloading it dynamically with `npx`. 4. Avoid `npx -y` for security-sensitive runtime components. 5. Disable npm lifecycle scripts where they are not required. 6. Run the MCP server in a sandbox or container with: - A read-only filesystem where possible. - No access to unrelated user files. - Restricted outbound network access. - A dedicated, unprivileged operating-system account. 7. Issue a narrowly scoped API token and rotate it periodically. 8. Monitor dependency ownership, release provenance, and published package checksums. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:10
• Finding: Remote Identity Context and Directives Can Influence Agent Behavior Without a Defined Trust Boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10-14` and `SKILL.md:38-42` **Additional Location**: `identity-patch.md:3-9` **Vulnerability Type**: Untrusted remote content used as agent context or behavioral guidance **Risk Level**: Medium ### Vulnerable Code ```markdown ## Session Start When you begin a new session, fetch your organizational context: ```bash mcporter call uplo-accounting.get_identity_context ``` ``` ```markdown **Get directives:** ```bash mcporter call uplo-accounting.get_directives ``` ``` The identity patch also mandates remote consultation: ```markdown When users ask about account balances, tax positions, or reconciliation status, always query UPLO first to provide answers grounded in your organization's actual books and records. ``` ### Technical Analysis The Skill instructs the agent to retrieve identity context at session start and exposes a remote `get_directives` operation. Retrieved content originates from the configured UPLO endpoint, but the Skill does not establish an explicit trust boundary between remote data and authoritative agent instructions. No strict response schema, instruction filtering, content sanitization, signature verification, or rule preventing remote content from altering agent behavior is specified. If the configured endpoint, UPLO account, or underlying knowledge content is compromised, an attacker may return instruction-like text designed to redirect tool use or influence disclosure decisions. This is an instruction-hijacking risk rather than evidence of an embedded malicious prompt. The project itself does not contain a destructive directive; the vulnerability is that mutable remote content can be incorporated into the agent's operational context without adequate controls. ### Attack Path 1. An attacker compromises the configured UPLO service, an authorized account, or content used to generate identity context and directives. 2. The attacker inserts instruction-like content int ...[truncated 1239 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every remote response as untrusted data rather than executable or authoritative instructions. 2. Define strict, data-only schemas for identity context and directives. 3. Explicitly state that remote content cannot override system, developer, safety, privacy, or user instructions. 4. Reject directive fields containing tool commands, role changes, instruction overrides, or requests to disclose unrelated data. 5. Validate the configured endpoint against an administrator-controlled HTTPS allowlist. 6. Require certificate validation and, where feasible, cryptographic response signing. 7. Apply least privilege to the UPLO token so injected instructions cannot access unrelated organizational records. 8. Require explicit user confirmation before a remotely supplied directive triggers sensitive retrieval, export, or disclosure. 9. Record and audit directive changes, including the author, timestamp, and source. 10. Separate quoted organizational policy content from agent control instructions in both prompts and user-visible output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:44
• Finding: Conversation-Derived Data Is Sent to a Remote Service Without Explicit Consent or Redaction Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:44-49` **Vulnerability Type**: Insufficiently controlled transmission of sensitive conversation metadata **Risk Level**: Medium ### Vulnerable Code ```markdown ## Session End Log the conversation: ```bash mcporter call uplo-accounting.log_conversation summary="Brief summary" topics='["topic1"]' tools_used='["search_knowledge"]' ``` ``` ### Technical Analysis The session-end workflow instructs the agent to transmit a conversation summary, topics, and tool-use history to the configured remote UPLO service. Accounting conversations can contain confidential account balances, tax positions, reconciliation details, document names, personal information, and other regulated or commercially sensitive data. The instruction does not require: - Explicit user consent. - Removal of financial values or personal data. - Classification-aware filtering. - Data minimization. - Verification of the destination before transmission. - A defined retention or deletion policy. Although the identity patch tells the agent to respect classification tiers, it does not provide concrete controls for sanitizing conversation logs. A summary can reproduce sensitive information even when the full transcript is not transmitted. ### Attack Path 1. A user discusses confidential accounting or tax records with the agent. 2. The conversation includes sensitive values, account identifiers, document references, or personal information. 3. At session end, the agent generates the requested summary and topics. 4. The agent invokes `log_conversation`. 5. Conversation-derived information is transmitted to the configured remote endpoint. 6. If the destination is misconfigured, compromised, overly permissive, or subject to unsuitable retention practices, unauthorized parties may access the logged information. ### Impact Assessment The transmitted data is limited by the generated summary and metadata, but that content can still expose: ...[truncated 593 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make conversation logging opt-in rather than automatic. 2. Obtain explicit user approval before transmitting any conversation-derived data. 3. Apply classification-aware redaction before logging. 4. Remove account numbers, financial amounts, tax identifiers, names, email addresses, document identifiers, and other personal or confidential data. 5. Prefer minimal telemetry, such as a generic feature identifier and success status, instead of a natural-language summary. 6. Display the exact proposed log payload and destination before transmission for sensitive sessions. 7. Restrict logging to an administrator-approved HTTPS endpoint. 8. Define retention, access-control, deletion, and audit policies for stored logs. 9. Provide a configuration option that completely disables remote conversation logging. 10. Fail closed when the destination cannot be authenticated or when content classification is unknown. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructions require an API key and point users to a remote `AGENTDOCS_URL`, but the README does not warn that accounting knowledge and documents may be transmitted to an external service for indexing, search, and extraction. Because the skill is explicitly designed for bookkeeping, tax preparation, audit support, and financial statement workpapers, the omission can lead users to send highly sensitive financial data off-platform without understanding the privacy, compliance, and vendor-risk implications.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README advertises an `export_org_context` capability that can expose a full organizational context snapshot, but it provides no warning about the sensitivity of the data that may be included or the access controls required before using it. In an accounting-focused skill, organizational context may include financial records, tax documents, workpapers, and other confidential information, so normalizing bulk export without caution materially increases the risk of over-disclosure or misuse.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is presented as an accounting knowledge search tool, but its documented capabilities include fetching identity context and organizational context export, which materially expand data access beyond simple search. This creates a risk of over-collection or disclosure of sensitive organizational metadata without clear scoping, justification, or user awareness, especially in an accounting context where data is often confidential.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Documenting organizational context export without any warning or handling guidance encourages use of a capability that may expose sensitive internal structures, identities, or business information. In an accounting domain, exported context can amplify the sensitivity of related financial records by making them easier to correlate and misuse.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The session-end instruction to log conversations introduces a retention capability that is not disclosed in the skill's search-oriented description. Undisclosed logging of accounting-related conversations can capture sensitive financial, tax, or audit information and create privacy, compliance, and data-governance risks.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs automatic conversation logging without any notice to the user that their interaction may be recorded or stored. In an accounting workflow, users may provide highly sensitive financial and tax information, so silent retention increases privacy, confidentiality, and regulatory exposure.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instruction to log each conversation creates a built-in retention path for user-supplied accounting content, including potentially sensitive bookkeeping, tax, audit, or financial statement details. Even if intended for operational tracking, storing natural-language summaries and topics can preserve confidential information and increase breach or misuse impact.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The manifest description is very broad for a skill that can search bookkeeping records, tax documents, audit files, and export organizational context. Without clear trigger constraints or scoped activation guidance, an agent may invoke this skill in loosely related conversations and expose sensitive financial data beyond user intent. In an accounting context, overbroad activation is more dangerous because the underlying data is likely confidential and regulated.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The configuration hard-codes 'DEFAULT_PACKS' to 'accounting', which imposes a default domain/context selection without indicating user choice or documented opt-in. Under natural-language policy review, fixed defaults that constrain language/locale/domain behavior should be justified or made user-selectable when not clearly documented as region- or compliance-specific.

Static analysis

No suspicious patterns detected.