Uplo Compliance

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:21 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with compliance search, but it needs review because it runs an unpinned MCP package with a secret token and exposes broad organizational compliance context.

Install only if you trust the UPLO endpoint, the @agentdocs1 npm package supply chain, and the configured token scope. Prefer a pinned, reviewed MCP server version, use a least-privilege and revocable token, and require explicit approval before exporting organizational context or using regulated compliance data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: skill.json:26

Finding

Unpinned npm Package Is Automatically Executed with Access to the MCP API Key

Content

View full analysis

Vulnerability Details

File Location: skill.json:26-36; duplicated in installation guidance at README.md:21-26
Vulnerability Type: Unpinned third-party dependency execution with secret access
Risk Level: High

Vulnerable Code

skill.json:26-36:

json

"command": "npx",
"args": [
  "-y",
  "@agentdocs1/mcp-server",
  "--http"
],
"env": {
  "AGENTDOCS_URL": "${config.agentdocs_url}",
  "API_KEY": "${config.api_key}",
  "DEFAULT_PACKS": "legal,finance,government"
},

The same unsafe execution pattern is documented in README.md:21-26:

json

"command": "npx",
"args": ["-y", "@agentdocs1/mcp-server", "--http"],
"env": {
  "AGENTDOCS_URL": "https://your-instance.uplo.ai",
  "API_KEY": "your-api-key",
  "DEFAULT_PACKS": "legal,finance,government"
}

Technical Analysis

The Skill invokes npx -y @agentdocs1/mcp-server --http without specifying an exact package version or validating package integrity. Depending on the local npm cache and environment, npx can retrieve the current package release from the configured npm registry and execute it immediately. The -y option suppresses the interactive installation confirmation.

The executed package inherits the configured environment, including API_KEY and AGENTDOCS_URL. Consequently, the security of the API credential and connected compliance data depends on every package version subsequently resolved under this unpinned package name.

If the package, its publisher account, one of its transitive dependencies, or the configured registry is compromised, attacker-controlled code could execute during Skill startup. There is no evidence that the current package is malicious; the vulnerability is the lack of deterministic dependency pinning and integrity enforcement while granting the dependency access to a secret.

Attack Path

1. An attacker compromises the @agentdocs1/mcp-server publisher account, package ...[truncated 1466 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example:

   json

   "args": [
     "-y",
     "@agentdocs1/mcp-server@1.2.3",
     "--http"
   ]
   

   Replace the example version with a release that has been independently reviewed and approved.

2. Avoid downloading packages during Skill startup. Install dependencies during a controlled build or deployment phase and execute the verified local binary.

3. Commit and enforce a lockfile with integrity hashes. Use deterministic installation such as npm ci from a trusted registry.

4. Verify package provenance, signatures, ownership, and release integrity before upgrades. Introduce dependency review and automated supply-chain scanning into the release process.

5. Replace long-lived API keys with short-lived, revocable credentials. Scope the token to only the MCP tools, data classifications, and organizational domains required by this Skill.

6. Run the MCP package in a sandbox or isolated container with restricted filesystem access, minimal operating-system privileges, and outbound network access limited to the approved UPLO endpoint.

7. Remove -y where runtime installation remains unavoidable so unexpected installation or resolution changes are not silently accepted.

8. Update the README.md configuration example to use the same pinned and hardened execution method, preventing users from copying the insecure configuration.

9. Rotate the API key promptly if an untrusted package version has previously been executed, and review MCP access logs for unexpected queries, exports, updates, or connections.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises an export_org_context capability that implies bulk extraction of full organizational context, but it does not warn that this may include sensitive, confidential, or regulated data. In a compliance-focused skill handling legal, financial, and government information, presenting this export function without clear access-control, least-privilege, and data-handling cautions increases the risk of inadvertent overexposure or misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description presents the skill as broadly applicable across legal, financial, and government compliance domains without defining clear trigger boundaries or limiting conditions. In an agent environment, this can cause over-invocation in sensitive contexts and increase the chance that the skill is used on regulated or confidential data when a narrower, more explicit scope would be appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises an export capability via export_org_context in a product focused on compliance, legal, financial, and government data, but provides no user-facing warning, sensitivity labeling, or confirmation requirement. Because this context is likely to include regulated or confidential organizational information, an agent could expose or transfer large volumes of sensitive data without the user clearly understanding the disclosure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.