Uplo Construction

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for construction knowledge search, but its install path runs an unpinned npm MCP server with the user's UPLO API token and has weak disclosure around sensitive organizational data access.

Install only if you trust the UPLO service, the npm package publisher, and the configured MCP host. Use a least-privilege UPLO token, avoid administrative credentials, restrict the projects and export permissions available to the token, and consider pinning or otherwise verifying the MCP server package before running it with sensitive construction records.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: skill.json:24

Finding

Unpinned Third-Party npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: skill.json:24-31; installation example repeated in README.md:17-29
Vulnerability Type: Unpinned dependency execution and supply-chain exposure
Risk Level: High

Vulnerable Code

skill.json:24-31:

json

"mcp": {
  "command": "npx",
  "args": [
    "-y",
    "@agentdocs1/mcp-server",
    "--http"
  ],
  "env": {

The same unsafe installation pattern is documented in README.md:17-29:

json

{
  "mcpServers": {
    "uplo-construction": {
      "command": "npx",
      "args": ["-y", "@agentdocs1/mcp-server", "--http"],
      "env": {
        "AGENTDOCS_URL": "https://your-instance.uplo.ai",
        "API_KEY": "your-api-key",
        "DEFAULT_PACKS": "construction"
      }
    }
  }
}

Technical Analysis

The skill invokes npx with the -y option and a package name that has no exact version or integrity constraint. Consequently, npx can retrieve and execute the package version currently resolved by the npm registry without asking the user for confirmation.

This creates a mutable supply-chain execution channel: the code executed during a future installation may differ from the code that existed when the skill was audited. The repository does not contain the MCP server source, a lockfile, a package integrity hash, or another mechanism that permits verification of the downloaded executable.

The configured MCP process also receives API_KEY and AGENTDOCS_URL through its environment. Any code executed through the npm package therefore runs with the local privileges of the user or agent host and may be able to read those inherited credentials. This finding does not establish that the current package is malicious; it identifies the absence of controls preventing a compromised or malicious future release from executing.

Attack Path

1. An attacker compromises the npm account, package publishing workflow, or r ...[truncated 1691 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact audited version, for example @agentdocs1/mcp-server@X.Y.Z; do not use a floating tag or version range.
2. Verify the package artifact with a trusted integrity hash or signature and fail closed if verification does not succeed.
3. Maintain and publish a lockfile or equivalent reproducible dependency manifest for the executable MCP server and its transitive dependencies.
4. Remove automatic -y acceptance where practical so unexpected downloads require explicit operator approval.
5. Document and independently verify the relationship between the advertised UPLO service and the @agentdocs1 npm publisher.
6. Prefer a reviewed, immutable package artifact or bundled audited server rather than downloading executable code at startup.
7. Run the MCP server in a sandbox or container with a read-only filesystem, minimal filesystem access, no host administrative privileges, and tightly restricted outbound networking.
8. Issue a dedicated, short-lived API token with only the project and read/write capabilities required by this skill. Do not reuse administrative tokens.
9. Prevent the MCP process from inheriting unrelated secrets and environment variables.
10. Add dependency provenance, signature, vulnerability, and ownership checks to the release process, and update both skill.json and the README.md example to use the secured invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The configuration shows a remote AGENTDOCS_URL endpoint and API-based service usage, but the README does not clearly warn that project documents, metadata, and extracted knowledge may be transmitted to an external service. For a construction knowledge platform handling safety records, permits, building codes, and RFIs, this omission can lead users to send sensitive project or compliance data off-premises without informed consent or proper review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises an export_org_context capability that suggests bulk export of organizational knowledge, but it provides no warning about the sensitivity of that data, access restrictions, or privacy implications. In a construction context, exported data may include permits, compliance records, RFIs, internal project details, and potentially confidential operational information, increasing the risk of overcollection or misuse by users who do not appreciate the scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill description is broad and does not clearly limit when the skill should or should not be invoked, which can cause an agent to route general document, compliance, or project-management requests into this skill unnecessarily. In a construction context, that over-broad activation is risky because the skill handles potentially sensitive project records, safety compliance data, permits, and legal/dispute-related documentation, increasing the chance of inappropriate access, data over-collection, or reliance on stale context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.