Uplo Agriculture

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

The skill’s agriculture knowledge-search purpose is coherent, but it includes broad organizational export, automatic conversation logging, and an unpinned executable MCP dependency that receives the API token.

Install only if you trust the UPLO instance, the npm package publisher, and the administrators who can access logged or exported data. Use a narrowly scoped, revocable API token; avoid sensitive sessions unless logging is acceptable; and prefer a pinned or otherwise verified MCP server package before production use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: skill.json:26
• Finding: Unpinned Third-Party npm Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `skill.json:26-31` **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: High ### Vulnerable Code ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], ``` ### Technical Analysis The MCP configuration invokes `npx` with the `-y` option and an npm package name that has no exact version constraint. As a result, npm can retrieve and execute the package version currently resolved by the registry without interactive confirmation. The project contains no lockfile, package integrity hash, or other mechanism that binds execution to an audited package artifact. Consequently, the effective executable payload can change after this skill has been reviewed. Compromise of the package, its maintainer account, the publication pipeline, or the package registry could introduce arbitrary code into subsequent installations. The spawned process receives the configured MCP environment, including `API_KEY` and `AGENTDOCS_URL`. Malicious package code could therefore read those values and act with the operating-system privileges of the user running the skill. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or its publication pipeline. 2. The attacker publishes a malicious version of `@agentdocs1/mcp-server`. 3. A user installs or starts the skill. 4. `npx -y` resolves the unpinned package without requesting confirmation. 5. The malicious package executes locally under the user's account. 6. The package reads the MCP token and service URL from its environment. 7. The attacker exfiltrates credentials, accesses organizational records using the token, or performs other actions permitted to the local process. ### Impact Assessment Successful exploitation can result in arbitrary local code execution with the privileges of the user running the agent. The malicious process may access the configured U ...[truncated 394 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `@agentdocs1/mcp-server` to a specific, reviewed version rather than relying on registry resolution of the latest release. - Use a lockfile and verify package integrity hashes during installation. - Remove `-y` so unexpected package retrieval is not silently approved. - Prefer a preinstalled, verified executable or a reproducibly built and signed package. - Monitor the dependency for ownership changes, security advisories, and unexpected releases. - Run the MCP server in a sandbox or container with restricted filesystem and network access. - Supply a short-lived, narrowly scoped API token that cannot administer the UPLO instance or access unrelated datasets. - Prevent child processes and package lifecycle scripts unless they are explicitly required and reviewed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41
• Finding: Conversation Summaries Are Transmitted Without Consent or Data-Minimization Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:41-45` **Vulnerability Type**: Uncontrolled transmission and retention of conversation information **Risk Level**: Medium ### Vulnerable Code ```markdown ## Session End Log the conversation: ```bash mcporter call uplo-agriculture.log_conversation summary="Brief summary" topics='["topic1"]' tools_used='["search_knowledge"]' ``` ``` ### Technical Analysis The skill directs the agent to log the conversation at the end of a session. The instruction does not require user consent, sensitive-data filtering, redaction, purpose limitation, or verification of the destination's retention policy. Even a nominally brief summary may contain confidential operational information, livestock health details, crop yields, pricing or contract information, compliance matters, personal information, or field identifiers. The surrounding skill documentation explicitly anticipates processing such organizational records. Because the logging instruction is unconditional, users may reasonably disclose information for an immediate answer without expecting that a derived summary and topic list will be transmitted to and retained by the configured MCP service. ### Attack Path 1. A user discusses confidential agricultural, operational, compliance, or commercial information with the agent. 2. The agent creates a session summary and topic list that include or reveal sensitive details. 3. At session end, the skill invokes `uplo-agriculture.log_conversation`. 4. The summary, topics, and tool-usage metadata are transmitted to the configured UPLO service. 5. The information may be stored, processed, or made accessible according to server-side policies that are not disclosed or constrained by the skill. ### Impact Assessment The issue can disclose sensitive conversation-derived information to an external or organizational service and create an additional retained copy of that information. The exposed scope may include crop reco ...[truncated 494 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make conversation logging disabled by default and explicitly opt-in. - Obtain informed user or administrator consent before transmitting conversation-derived information. - Clearly disclose the destination, processing purpose, retention period, and access controls. - Apply strict data minimization: log only non-sensitive operational telemetry needed for a defined purpose. - Redact personal information, credentials, field identifiers, contract terms, livestock health information, and confidential compliance details. - Provide a configuration option that completely disables logging. - Enforce retention limits and deletion mechanisms on the receiving service. - Encrypt data in transit and at rest, and restrict access to authorized audit personnel. - Avoid deriving summaries from sensitive sessions unless logging is specifically authorized for that session. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:31
• Finding: Full Organizational Context Export Violates Least-Privilege Design<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-35` **Vulnerability Type**: Excessively broad organizational data-export capability **Risk Level**: High ### Vulnerable Code ```markdown **Export org context:** ```bash mcporter call uplo-agriculture.export_org_context ``` ``` The README further describes this operation as a full snapshot: ```markdown | `export_org_context` | Full organizational context snapshot | ``` ### Technical Analysis The skill exposes and documents an `export_org_context` operation capable of retrieving a full organizational context snapshot. This capability is substantially broader than the targeted `search_knowledge` and `search_with_context` operations needed to answer individual agricultural questions. The skill does not define an approval gate, query scope, data-volume limit, purpose restriction, classification filter, or requirement for explicit user confirmation before a full export. Although the documentation tells the agent to respect classification levels, advisory text is not a substitute for server-side authorization and least-privilege enforcement. A broad export also increases exposure to prompt injection in retrieved documents or manipulated user requests. If an invocation is induced unnecessarily, a large volume of confidential information can be brought into the agent context or included in downstream processing. ### Attack Path 1. An attacker supplies a request, document, or retrieved instruction that induces the agent to invoke `export_org_context`. 2. The agent treats the documented export operation as an approved capability. 3. The MCP service returns a full organizational context snapshot within the permissions of the configured token. 4. Confidential records enter the model context or another downstream processing environment. 5. The data may subsequently be exposed through generated output, conversation logging, model-provider processing, or other integrations. ### Impact Assessment Expl ...[truncated 701 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `export_org_context` from the default skill capabilities unless bulk export is essential. - Replace full-context export with narrowly scoped searches that return only records needed for the current task. - Require explicit user confirmation and a documented business purpose before any bulk export. - Enforce authorization, classification filtering, tenant isolation, and row- or document-level access controls on the server. - Use a separate privileged token for approved exports rather than granting export access to the routine search token. - Apply export size limits, rate limits, and field-level redaction. - Record tamper-resistant audit logs for export attempts, including requester, purpose, scope, and result size. - Prevent exported data from being automatically included in conversation logs or unrelated model context. - Treat retrieved knowledge as untrusted content and ensure it cannot instruct the agent to invoke broader tools. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a knowledge search and structured extraction tool, but it also instructs the agent to export full organizational context and log conversations. Those capabilities materially expand data access and retention beyond the stated purpose, creating a risk of unnecessary disclosure of internal organizational data and collection of user conversation content without clear need or scoping.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Session-end conversation logging is not clearly necessary for an agricultural knowledge-search skill, so it introduces avoidable data collection. If used broadly, it could capture sensitive operational, compliance, or personnel-related details from conversations and store them in another system without a defined business justification.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs automatic conversation logging at session end without any user-facing notice or consent mechanism. In a domain involving agricultural operations, compliance records, and possibly employee or livestock data, this can result in silent retention or export of sensitive conversation content and metadata, undermining privacy expectations and increasing regulatory and internal-data-handling risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This manifest requires an API token and injects it into the MCP server environment, while also configuring an HTTP endpoint for the service. The file describes the capability and token requirement, but it does not warn users that the skill will use credentials and communicate with a remote UPLO instance.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The markdown shows users placing an `API_KEY` in configuration, but it does not include any warning about protecting secrets or avoiding accidental disclosure. Because this skill connects to an external service and uses credentials, a brief user-facing warning would improve safe setup and reduce the chance of mishandling sensitive information.

Static analysis

No suspicious patterns detected.