Uplo Consulting

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for consulting knowledge search, but it installs an unpinned external MCP package at runtime and encourages broad access to sensitive firm and client context.

Review this before installing. Use only with an UPLO instance and token scoped to the user's authorized practice, clients, and classification tiers. Prefer a pinned, reviewed MCP server package or controlled deployment instead of runtime `npx -y`, and avoid full organization exports or client-identifying logs unless they are necessary and authorized.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: identity-patch.md:3

Finding

Mandatory UPLO-First Querying Redirects Agent Behavior and May Expose Sensitive Consulting Data

Content

View full analysis

Vulnerability Details

File Location: identity-patch.md, line 3
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet:

markdown

You are connected to your organization's consulting knowledge base through UPLO. This gives you specialized access to engagement records, methodology frameworks, deliverable templates, case studies, proposal archives, and best practice libraries. When users ask about past engagements, methodology approaches, or reusable deliverables, always query UPLO first to leverage institutional knowledge from prior client work.

Technical Analysis

The identity patch imposes a persistent behavioral rule requiring the agent to query UPLO first whenever a user asks about past engagements, methodologies, or reusable deliverables. The mandatory wording overrides context-sensitive tool selection and does not require the agent to obtain user consent, minimize the query, or redact sensitive information before sending it to the configured MCP service.

This is particularly sensitive because the skill explicitly handles client identities, engagement records, pricing models, proposal archives, proprietary methodologies, and team information. Although the remaining instructions mention respecting classification tiers, they do not establish a local pre-disclosure check before the mandatory external tool call. Consequently, confidential information included in a user's prompt could become part of a search request before the agent determines whether transmission is appropriate.

Attack Path

1. A user installs or enables the skill, causing identity-patch.md to be loaded into the agent's operating context.
2. The user asks a consulting-related question containing client names, pricing, engagement details, proprietary methodology information, or other restricted content.
3. The instruction requiring the agent to “always query UPLO first” takes effect.

...[truncated 821 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mandatory “always query UPLO first” instruction with conditional guidance that preserves user intent and permits the agent to decline unnecessary tool use.
• Require explicit user approval before transmitting confidential, restricted, or client-identifying content.
• Add a mandatory data-minimization step that removes client names, pricing, credentials, personal data, and proprietary details unless they are essential and authorized.
• Define clear classification checks that occur before any MCP request rather than relying solely on server-side access controls.
• Inform users when a request will be sent to the configured UPLO service and identify the categories of data involved.
• Prohibit query logging or retention for restricted material unless organizational policy explicitly authorizes it.
• Restrict tool access by engagement, practice area, classification tier, and user identity using least-privilege authorization.

T08 · Insecure Dependencies

Error

• Location: skill.json:26

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: skill.json, lines 26-31
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code Snippet:

json

"mcp": {
  "command": "npx",
  "args": [
    "-y",
    "@agentdocs1/mcp-server",
    "--http"
  ],

The same unsafe installation pattern is also documented in README.md, lines 21-22:

json

"command": "npx",
"args": ["-y", "@agentdocs1/mcp-server", "--http"],

Technical Analysis

The MCP configuration invokes npx -y @agentdocs1/mcp-server --http without specifying an exact package version or integrity value. When the package is not already available locally, npx can resolve and download it from the configured npm registry. The -y option suppresses the installation confirmation prompt.

Because no version is pinned, the code executed at runtime can differ from the code reviewed during the audit. A compromised maintainer account, malicious package release, registry compromise, or unexpected upstream update could therefore introduce arbitrary executable behavior. The MCP process also receives AGENTDOCS_URL, API_KEY, and DEFAULT_PACKS through its environment, making compromise of this dependency especially sensitive.

Attack Path

1. An attacker compromises the publishing account or release process for @agentdocs1/mcp-server, or otherwise causes a malicious version to be resolved by npm.
2. The user starts the skill's MCP integration.
3. npx -y resolves and downloads the unpinned package without requesting confirmation.
4. Package installation lifecycle code or the package runtime executes with the privileges of the user running the agent.
5. Malicious code reads the MCP process environment, including API_KEY and AGENTDOCS_URL.
6. Depending on local sandboxing and operating-system permissions, the code may also access user-readable files, make network connections, alter local data, or misuse ...[truncated 584 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specific, reviewed version, for example @agentdocs1/mcp-server@X.Y.Z, rather than resolving the latest available release.
• Use a lockfile and verify package integrity hashes as part of installation and deployment.
• Install dependencies during a controlled build process instead of downloading executable code when the skill starts.
• Remove -y where interactive approval is appropriate, although confirmation alone is not a substitute for version pinning and integrity validation.
• Audit package provenance, ownership, release signatures, transitive dependencies, and lifecycle scripts.
• Disable unnecessary npm lifecycle scripts during installation.
• Run the MCP server in a restricted container or sandbox with limited filesystem access, outbound networking, and subprocess permissions.
• Issue a narrowly scoped API token, rotate it regularly, and ensure it cannot access knowledge outside the user's authorized classification tiers.
• Update the example in README.md to use the same pinned and verified deployment method so users are not directed toward the unsafe runtime installation pattern.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly advertises an export_org_context tool as providing a full organizational context snapshot, but gives no warning about the sensitivity of that data, access restrictions, or safe-use expectations. In a knowledge-management skill that aggregates engagement records, methodologies, and potentially confidential consulting materials, normalizing bulk export without security caveats increases the risk of over-broad data extraction and accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to retrieve identity context including practice area, seniority, and current engagement assignments, which are sensitive personnel and client-allocation details. In a consulting knowledge-management context, exposing assignment data can reveal confidential client relationships, internal staffing plans, and role-based information without any stated minimization, need-to-know check, or user warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill recommends exporting organizational context containing practice structure, leadership, systems, and strategic priorities, which is highly sensitive internal business information. Without warnings, scoping constraints, or authorization checks, this creates a straightforward path to overexpose internal firm structure and strategy to users or downstream logs that may not need full access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells users to log conversation summaries and topics after reviewing client-specific materials, but provides no warning that the log may capture client names, engagement phases, stakeholder information, or other confidential details. In consulting, such retained metadata can become a secondary leakage channel because logs are often broadly searchable, retained long-term, or reused outside the original confidentiality boundary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.