Uplo Customer Success

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:27 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for customer-success knowledge work, but it runs an unpinned external MCP package with an API token and includes broad organization-wide export guidance that users should review carefully.

Install only if you trust UPLO and the npm package publisher, can pin or otherwise control the MCP server version, and can use a narrowly scoped UPLO token. Treat `export_org_context` as a bulk sensitive-data operation: restrict it to authorized roles, confirm scope before use, and prefer account-scoped searches for ordinary handoffs or account reviews.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: skill.json:25
• Finding: Unpinned npm Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `skill.json:25-31`; also documented in `README.md:18-29` **Vulnerability Type**: Unpinned runtime dependency execution **Risk Level**: Medium ### Vulnerable Code `skill.json:25-31`: ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], ``` Corresponding installation configuration in `README.md:18-29`: ```json { "mcpServers": { "uplo-customer-success": { "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { "AGENTDOCS_URL": "https://your-instance.uplo.ai", "API_KEY": "your-api-key", "DEFAULT_PACKS": "customer_success" } } } } ``` ### Technical Analysis The Skill starts its MCP server using `npx -y @agentdocs1/mcp-server --http`. No exact package version, package integrity hash, lockfile, or locally reviewed implementation is supplied. The `-y` option suppresses installation confirmation. If the package is not already available locally, `npx` may retrieve the package from the configured npm registry and immediately execute it. Because no version is pinned, the effective executable can change independently of the reviewed Skill artifact. This creates a supply-chain trust boundary: the package publisher, publishing credentials, npm registry configuration, and latest resolved package release can determine what code executes. The repository itself contains only configuration and documentation, so the behavior of the executed MCP server cannot be verified from the audited files. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution process, registry resolution path, or a future release of `@agentdocs1/mcp-server`. 2. The attacker publishes a modified package version under the same package name. 3. A user installs or starts the Skill using the provided configuration. 4. `npx -y` resolves and downloads the unpinned package without req ...[truncated 1160 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@agentdocs1/mcp-server` to a specific, reviewed version rather than relying on the latest registry resolution. 2. Commit a lockfile containing package integrity metadata and deploy using a deterministic installation mechanism such as `npm ci`. 3. Avoid runtime installation through `npx -y`. Install the reviewed dependency during a controlled build or deployment stage. 4. Verify package provenance using npm signatures, trusted publishing metadata, checksums, or an internal package registry. 5. Apply an explicit dependency-update review process, including source review, vulnerability scanning, and regression testing. 6. Run the MCP server in a sandbox or container with minimal filesystem and network privileges. 7. Supply a narrowly scoped, short-lived API token rather than a broadly privileged credential. 8. Restrict inherited environment variables so the MCP process receives only values strictly required for operation. 9. Document the package version, integrity value, publisher identity, and expected server behavior in the Skill package. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:85
• Finding: Full Organizational Context Export Exceeds Routine Account-Lookup Scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:85`; capability also declared in `skill.json:42` and documented in `README.md:46` **Vulnerability Type**: Overbroad organizational data access **Risk Level**: Low ### Vulnerable Code `SKILL.md:85`: ```markdown - CSM handoff is the highest-risk moment in the customer lifecycle. Use `export_org_context` combined with account-specific searches to build a comprehensive handoff document rather than relying on a 30-minute call. ``` `README.md:46`: ```markdown | `export_org_context` | Full organizational context snapshot | ``` Relevant capability declaration in `skill.json`: ```json "capabilities": [ "search_knowledge", "search_with_context", "get_policy", "export_org_context", "get_directives" ], ``` ### Technical Analysis The Skill is intended to support customer-success activities such as account health checks, onboarding reviews, renewals, and account handoffs. These workflows normally require access to one account or a limited portfolio. However, the Skill declares `export_org_context`, describes it as a “Full organizational context snapshot,” and explicitly recommends using it for an account handoff. This is broader than the data scope required to prepare a handoff for a particular customer. The documentation states that classification tiers should be respected, but the audited artifact does not demonstrate server-side authorization, field-level filtering, account scoping, export confirmation, or output minimization. Because the MCP implementation is external and absent from the project, enforcement cannot be verified through this audit. The risk arises from unnecessary data aggregation. Even where individual records are authorized, retrieving an organization-wide snapshot into a model context creates greater exposure than targeted account searches. ### Attack Path 1. A user asks the agent to prepare a handoff document for one customer account. 2. The agent follows the recomm ...[truncated 1591 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `export_org_context` in ordinary handoff workflows with an account-scoped export operation. 2. Remove guidance encouraging full organizational exports when targeted searches satisfy the task. 3. Enforce authorization, tenant separation, classification filtering, and account scope on the server regardless of agent instructions. 4. Require explicit user confirmation before any bulk or organization-wide export. 5. Display the intended scope, record count, and data classifications before executing an export. 6. Apply field minimization so handoff output includes only necessary customer-success information. 7. Use separate roles or tokens for scoped search and bulk export; do not grant bulk-export permission by default. 8. Audit all organizational exports, including requester identity, scope, purpose, result size, and destination. 9. Prevent exported confidential or restricted records from being written to conversation logs unless explicitly authorized. 10. Add automated tests confirming that account-level requests cannot return records belonging to unrelated accounts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to configure a plaintext API key and advertises capabilities such as `export_org_context`, which implies bulk access to organizational knowledge, but it does not warn about handling sensitive data, least-privilege scoping, or access restrictions. In a customer success context, the indexed data may include account health, escalations, renewals, and other confidential customer/business records, so normalizing broad export access without safety guidance increases the chance of overexposure or misuse.

Vague Triggers

Low

• Confidence: 89% confidence
• Finding: This is a manifest file, so vague-trigger review applies. The description explains the skill's domain and capabilities but does not specify when the skill should be invoked, what phrases should activate it, or any exclusion conditions, which can lead to overly broad routing for general customer-success queries.

Static analysis

No suspicious patterns detected.