T08 · Insecure Dependencies
Warning
- Location
skill.json:30- Finding
Automatic Execution of an Unpinned Third-Party npm Package
- Content
View full analysis
- Remediation
View remediation
Security audit
Uplo Customer 360
Security checks for vulnerabilities and agentic risk
Overview
The skill’s customer-intelligence purpose is coherent, but it uses a mutable third-party MCP package with an API key and enables broad customer and organizational data access that needs review before installation.
Install only if you trust the UPLO instance and MCP package supply chain, can issue a least-privilege UPLO token, and can restrict access to assigned accounts and approved datasets. Review or pin the MCP server package version before use, and treat exports and broad customer searches as confidential operations that may expose sensitive business or customer data.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises tools such as
export_org_context,search_knowledge, andsearch_with_contextthat can expose broad internal organizational knowledge, but it does not warn users that these capabilities may return sensitive or regulated data. In a customer lifecycle and Customer 360 context, those searches can include sales pipeline details, account health, customer analytics, and other confidential business information, increasing the risk of over-broad deployment or unsafe user assumptions.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill is defined with a very broad purpose and no clear trigger boundaries, exclusions, or least-privilege guidance. In a customer intelligence context, that increases the chance the agent will be invoked for overly broad account discovery, cross-functional data access, or ambiguous requests that expose more customer information than necessary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation encourages unified access to sales, support, onboarding, NPS, and retail analytics data, but it does not warn about handling sensitive customer data, need-to-know access, or restrictions on personal/confidential information. Because the skill explicitly aggregates multiple business systems, missing privacy and authorization guidance raises the risk of inappropriate disclosure, over-collection, and misuse of sensitive commercial or customer data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill declares an export_org_context capability even though its stated purpose is customer lifecycle search and intelligence. That capability can enable broad extraction of organizational data beyond what is necessary for search workflows, increasing the blast radius if the skill is misused, over-privileged, or compromised.
- Content
Static analysis
No suspicious patterns detected.