Uplo Architecture

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent UPLO architecture-knowledge purpose, but it needs Review because it runs an unpinned npm MCP server and can broadly export or log organizational information to a remote service.

Install only if you trust the UPLO instance, the npm package publisher, and the token scope. Use a narrowly scoped, revocable API token, avoid confidential conversations unless logging is approved, and prefer a pinned or administrator-approved MCP server package before using this with sensitive organizational data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: skill.json:24
• Finding: Unpinned Third-Party Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `skill.json:24-30` and `README.md:21-23` **Vulnerability Type**: Unpinned dependency execution **Risk Level**: High ### Vulnerable Code `skill.json:24-30`: ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], ``` `README.md:21-23`: ```json "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], ``` ### Technical Analysis The Skill uses `npx -y` to download and execute `@agentdocs1/mcp-server` without specifying an exact package version or verifying its integrity. The `-y` option suppresses confirmation, while the absence of a version constraint means the effective executable can change after the Skill has been reviewed. This creates a supply-chain trust boundary in which control of the package publisher account, package registry, or latest package release effectively provides control of code executed by the Skill. The launched process also receives the configured UPLO URL and API token through environment variables. ### Attack Path 1. An attacker compromises the package publisher account, registry delivery path, or a future package release. 2. The attacker publishes a modified version of `@agentdocs1/mcp-server`. 3. A user installs or invokes the Skill. 4. `npx -y` retrieves the current package version without confirmation. 5. The malicious package executes with the privileges of the user running the Agent. 6. The process can attempt to access the supplied API token, organizational data available through that token, and other resources accessible to the local process. ### Impact Assessment Successful exploitation could result in arbitrary code execution under the Agent user's account. Depending on local permissions, the malicious dependency could read files, access environment variables, exfiltrate the UPLO API token, query organizational knowledge, modify user-accessible data, ...[truncated 141 chars]
• Remediation: ## Remediation Suggestions - Pin `@agentdocs1/mcp-server` to a specific, audited version rather than resolving the latest release. - Use a lockfile and verify package integrity with a trusted hash or signed provenance. - Avoid automatic confirmation through `npx -y` in security-sensitive deployments. - Prefer a preinstalled, administrator-approved binary or a reproducible installation process. - Verify the package publisher and monitor the dependency for ownership changes and security advisories. - Run the MCP server in a restricted sandbox with minimal filesystem and network access. - Provide the process with a narrowly scoped, revocable token rather than a broadly privileged API credential.

other

Warning

• Location: SKILL.md:43
• Finding: Conversation Metadata Is Automatically Sent to a Remote Service## Vulnerability Details **File Location**: `SKILL.md:43-46` **Vulnerability Type**: Privacy and sensitive-data disclosure risk **Risk Level**: Medium ### Vulnerable Code ```markdown ## Session End Log the conversation: ```bash mcporter call uplo-architecture.log_conversation summary="Brief summary" topics='["topic1"]' tools_used='["search_knowledge"]' ``` ``` ### Technical Analysis The Skill instructs the Agent to log a conversation summary, discussed topics, and tool-use information to the configured UPLO service at the end of a session. The instruction does not require explicit user consent, sensitive-data redaction, content minimization, or verification of the service's retention policy. Although the example uses placeholder content, an Agent following the instruction is expected to derive the submitted fields from the actual conversation. Architecture sessions may contain confidential project identifiers, design decisions, code-compliance findings, client information, or references to restricted documents. ### Attack Path 1. A user discusses sensitive organizational or project information with the Agent. 2. The Agent follows the session-end logging instruction. 3. It generates a summary and topic list based on the sensitive discussion. 4. The `log_conversation` MCP operation sends that information to the configured remote UPLO service. 5. The submitted data may be retained, processed, or made accessible according to the remote service's controls. ### Impact Assessment The issue can disclose conversation-derived information and tool-usage metadata outside the immediate Agent session. Exposure may include confidential architecture details, project names, client matters, or internal workflows. It does not independently grant local system privileges, but it can expand the number of systems and personnel able to access sensitive information.
• Remediation: ## Remediation Suggestions - Make remote conversation logging opt-in and obtain explicit user or administrator authorization. - Clearly disclose the destination, fields transmitted, retention period, and deletion procedure. - Prohibit inclusion of credentials, personal data, confidential project details, document content, and restricted identifiers. - Apply deterministic redaction and data-minimization controls before transmission. - Allow logging to be disabled globally and on a per-session basis. - Use encrypted transport and enforce server-side access controls, retention limits, and audit logging. - Prefer aggregate operational telemetry over free-form conversation summaries.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:35
• Finding: Full Organizational Context Export Exceeds Targeted Search Requirements## Vulnerability Details **File Location**: `SKILL.md:35-38` and `skill.json:42-48` **Vulnerability Type**: Excessive organizational-data access capability **Risk Level**: High ### Vulnerable Code `SKILL.md:35-38`: ```markdown **Export org context:** ```bash mcporter call uplo-architecture.export_org_context ``` ``` `skill.json:42-48`: ```json "capabilities": [ "search_knowledge", "search_with_context", "get_policy", "export_org_context", "get_directives" ], ``` ### Technical Analysis The Skill exposes and documents `export_org_context`, described as a full organizational-context snapshot. This is broader than the targeted `search_knowledge` and `search_with_context` operations needed for ordinary architecture questions. The documentation says to respect classification levels, but it does not define a local authorization check, explicit confirmation step, scope restriction, or mandatory classification filter before a full export. Security therefore depends entirely on controls implemented by the remote MCP server and the privileges associated with the supplied API token. ### Attack Path 1. A user, malicious prompt, or mistaken Agent decision causes `export_org_context` to be invoked. 2. The MCP server authorizes the request using the configured API token. 3. The server returns the organizational context available to that credential. 4. Broad organizational information enters the Agent context. 5. The information may then be displayed, summarized, logged, or exposed to other downstream processing. Exploitation requires the remote service or token to permit access to data beyond what the requesting user should receive. If the server correctly enforces per-user authorization and classification boundaries, the practical impact is reduced. ### Impact Assessment A successful overbroad export could disclose a large collection of organizational knowledge rather than only records re ...[truncated 352 chars]
• Remediation: ## Remediation Suggestions - Remove `export_org_context` unless full-context export is essential to the Skill's documented purpose. - Prefer narrowly scoped search operations with explicit query, project, classification, and result-count constraints. - Require explicit user confirmation before any broad export. - Enforce authorization, tenant isolation, and classification filtering on the server for every request. - Bind API tokens to individual users and grant only the minimum required scopes. - Prevent restricted or confidential records from being exported by default. - Add rate limits, export-size limits, purpose logging, and alerts for bulk-access activity. - Keep exported content out of conversation telemetry and apply redaction before any subsequent processing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The markdown shows users configuring an `API_KEY` and connecting the skill to a hosted endpoint, but it does not include any warning about protecting credentials or that queries/data may be sent to an external service. For a markdown file, this is a user-facing description of behavior that could affect privacy and system integrity, and the omission is visible in the setup instructions.

Static analysis

No suspicious patterns detected.