Uplo Cybersecurity

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:27 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for cybersecurity knowledge management, but it uses a mutable unpinned MCP package with a secret API token and exposes broad organizational security context without enough user controls.

Review before installing. Use a dedicated, least-privilege UPLO token, pin or otherwise control the MCP package version, run the server in a constrained environment, and require users to confirm and sanitize any full organizational exports or incident logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skill.json:25
• Finding: Unpinned Remote Package Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `skill.json:25-29` and `README.md:17-31` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High ### Vulnerable Code From `skill.json:25-29`: ```json "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], ``` The corresponding installation example in `README.md:17-31` is: ```json { "mcpServers": { "uplo-cybersecurity": { "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { "AGENTDOCS_URL": "https://your-instance.uplo.ai", "API_KEY": "your-api-key", "DEFAULT_PACKS": "cybersecurity" } } } } ``` ### Technical Analysis The skill launches `@agentdocs1/mcp-server` through `npx -y` without specifying an exact package version or verifying an integrity hash. When the package is absent from the local cache, `npx` may retrieve it from the configured npm registry. The `-y` option automatically accepts the installation prompt. Consequently, the code executed when the skill starts is not immutable and can change after the skill itself has been audited. A compromised npm publisher account, package registry, package release process, or malicious future release could introduce arbitrary code without requiring any modification to this repository. The child process receives the `API_KEY` and `AGENTDOCS_URL` environment variables configured in `skill.json:30-34`. Any code running inside the downloaded package can read those values. It also executes with the operating-system privileges of the application launching the MCP server. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or distribution channel for `@agentdocs1/mcp-server`. 2. The attacker publishes a malicious version under the same package name. 3. A user installs or starts this skill. 4. `npx -y @agentdocs1/mcp-server --http` resolves and downloads the malicious version automatically. ...[truncated 1217 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific, reviewed version, for example: ```json "args": [ "-y", "@agentdocs1/mcp-server@1.2.3", "--http" ] ``` 2. Prefer installing dependencies through a committed lockfile that records package integrity hashes rather than downloading the package dynamically on every launch. 3. Verify the package provenance and signature where supported, and restrict installation to a trusted registry. 4. Remove automatic installation consent where operationally practical. Require an explicit installation or upgrade step before runtime. 5. Run the MCP server in a sandbox or container with: - A read-only filesystem where possible. - No access to unrelated host files or environment variables. - Restricted outbound network access. - A non-privileged operating-system identity. 6. Issue a narrowly scoped API token dedicated to this skill. Do not reuse administrative or general-purpose credentials. 7. Establish a controlled dependency-update process that includes code review, vulnerability scanning, integrity verification, and regression testing before changing the pinned version. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.json:38
• Finding: Full Organizational Context Export Exceeds Least-Privilege Retrieval<![CDATA[ ## Vulnerability Details **File Location**: `skill.json:38-44`; behavior documented at `SKILL.md:65-69` **Vulnerability Type**: Overly broad sensitive-data capability **Risk Level**: Medium ### Vulnerable Code From `skill.json:38-44`: ```json "capabilities": [ "search_knowledge", "search_with_context", "get_policy", "export_org_context", "get_directives" ], ``` The intended use is documented in `SKILL.md:65-69`: ```markdown Export the organizational context to show the auditor the team structure and system ownership: ``` export_org_context ``` ``` ### Technical Analysis The skill grants `export_org_context`, described in `README.md` as providing a full organizational context snapshot. This is substantially broader than targeted retrieval through `search_knowledge` or `search_with_context`. The audited instructions emphasize that the underlying records can include restricted incident details, threat intelligence, vulnerability assessments, penetration-test findings, system ownership, and compliance evidence. However, the skill does not prescribe explicit user confirmation, field-level filtering, purpose limitation, or response redaction before invoking the full export capability. Server-side classification and authorization may limit the returned records, and the artifact does instruct the agent to respect clearance tiers. Therefore, this finding does not establish a direct access-control bypass. The risk is that a legitimately authorized but excessively broad capability can expose more information than a particular request requires, violating least-privilege and data-minimization principles. ### Attack Path 1. A user submits an overbroad request for organizational, audit, ownership, or security context. 2. Alternatively, untrusted content included in a request encourages the agent to obtain a complete organizational snapshot. 3. The agent invokes `export_org_context` rather than issuing narrowly scoped searches. 4. The UPLO serv ...[truncated 1186 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `export_org_context` from the default capability list unless full-context export is essential to the skill's core operation. 2. Prefer narrowly scoped `search_knowledge` or `search_with_context` calls that retrieve only records relevant to the user's stated task. 3. Require explicit user confirmation before any full organizational export. The confirmation should identify the expected data scope and intended recipient. 4. Enforce server-side authorization independently of agent instructions: - Apply classification-tier checks to every returned object. - Scope tokens to required collections and operations. - Deny restricted exports by default. - Prevent the client from overriding clearance filters. 5. Add field-level filtering and redact credentials, personal information, sensitive infrastructure details, and unrelated incident data. 6. Return summaries or bounded result sets instead of complete organizational snapshots. 7. Log export requests with the requesting identity, justification, record scope, timestamp, and recipient for subsequent audit. 8. Use short-lived, task-specific credentials and separate export permission from ordinary search permission. 9. Add documented handling requirements preventing broad export results from being copied into responses or logs unless explicitly necessary and authorized. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README advertises an `export_org_context` capability as a 'Full organizational context snapshot' without any warning about data sensitivity, access restrictions, or least-privilege expectations. In a cybersecurity knowledge management skill, this can normalize broad export of highly sensitive internal security, incident, and compliance information, increasing the risk of over-collection, accidental disclosure, or misuse by users and downstream agents.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly recommends logging incident investigation summaries that include sensitive operational details such as server names, C2 matches, and PII context, and also exporting organizational context for audit use without any warning, minimization guidance, or access-control caveats. In a cybersecurity setting, these actions can create secondary disclosure channels, expand the blast radius of sensitive incident data, and generate audit records or exports that may be accessible beyond the immediate need-to-know audience.

Static analysis

No suspicious patterns detected.