Security audit

Uplo Agriculture

Security checks for vulnerabilities and agentic risk

Overview

The skill’s agriculture knowledge-search purpose is coherent, but it includes broad organizational export, automatic conversation logging, and an unpinned executable MCP dependency that receives the API token.

Install only if you trust the UPLO instance, the npm package publisher, and the administrators who can access logged or exported data. Use a narrowly scoped, revocable API token; avoid sensitive sessions unless logging is acceptable; and prefer a pinned or otherwise verified MCP server package before production use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: skill.json:26
Finding: Unpinned Third-Party npm Package Is Downloaded and Executed Automatically
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:41
Finding: Conversation Summaries Are Transmitted Without Consent or Data-Minimization Controls
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:31
Finding: Full Organizational Context Export Violates Least-Privilege Design
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is presented as a knowledge search and structured extraction tool, but it also instructs the agent to export full organizational context and log conversations. Those capabilities materially expand data access and retention beyond the stated purpose, creating a risk of unnecessary disclosure of internal organizational data and collection of user conversation content without clear need or scoping.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Session-end conversation logging is not clearly necessary for an agricultural knowledge-search skill, so it introduces avoidable data collection. If used broadly, it could capture sensitive operational, compliance, or personnel-related details from conversations and store them in another system without a defined business justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs automatic conversation logging at session end without any user-facing notice or consent mechanism. In a domain involving agricultural operations, compliance records, and possibly employee or livestock data, this can result in silent retention or export of sensitive conversation content and metadata, undermining privacy expectations and increasing regulatory and internal-data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This manifest requires an API token and injects it into the MCP server environment, while also configuring an HTTP endpoint for the service. The file describes the capability and token requirement, but it does not warn users that the skill will use credentials and communicate with a remote UPLO instance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The markdown shows users placing an API_KEY in configuration, but it does not include any warning about protecting secrets or avoiding accidental disclosure. Because this skill connects to an external service and uses credentials, a brief user-facing warning would improve safe setup and reduce the chance of mishandling sensitive information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.