Uplo Engineering

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:52 PM UTC
• Version: 1.0.0

Overview

The skill fits its engineering knowledge-search purpose, but it runs an unpinned external MCP package with a secret API token and exposes broad organizational context, so users should review it before installing.

Install only if you trust the UPLO publisher and the @agentdocs1 npm package source. Prefer a pinned, reviewed MCP server version, use a dedicated least-privilege and rotated UPLO token, and confirm that export_org_context and any update/reporting tools are authorized for the organizational data this skill can access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.json:22

Finding

Automatic Execution of an Unpinned Third-Party MCP Package

Content

View full analysis

Vulnerability Details

File Location: skill.json:22-29 and README.md:19-27
Vulnerability Type: Unpinned executable dependency and unsafe automatic package resolution
Risk Level: Medium

Vulnerable Code

skill.json:22-29:

json

"mcp": {
  "command": "npx",
  "args": ["-y", "@agentdocs1/mcp-server", "--http"],
  "env": {
    "AGENTDOCS_URL": "${config.agentdocs_url}",
    "API_KEY": "${config.api_key}",
    "DEFAULT_PACKS": "engineering,it_devops,github"
  },

The same installation pattern is documented in README.md:19-27:

json

"mcpServers": {
  "uplo-engineering": {
    "command": "npx",
    "args": ["-y", "@agentdocs1/mcp-server", "--http"],
    "env": {
      "AGENTDOCS_URL": "https://your-instance.uplo.ai",
      "API_KEY": "your-api-key",
      "DEFAULT_PACKS": "engineering,it_devops,github"
    }

Technical Analysis

The configuration invokes npx with the automatic-confirmation option -y and specifies @agentdocs1/mcp-server without an exact version or verified integrity value. Consequently, package startup can resolve and execute whichever release the package registry currently serves rather than a specific release reviewed together with this skill.

This constitutes a supply-chain risk because remotely distributed package code is executed locally after the static skill package has been audited. The effective executable payload can therefore change independently of the reviewed files. The package process also receives API_KEY and AGENTDOCS_URL through its environment, placing sensitive authentication material directly within reach of the dependency.

The package namespace differs from the advertised UPLO product name, and the repository contains no package-provenance or integrity verification information. This does not establish malicious ownership, but it increases the importance of explicit publisher verification and immutable dependency pin ...[truncated 1649 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, audited version, for example:

   json

   "args": ["-y", "@agentdocs1/mcp-server@1.2.3", "--http"]
   

   Replace the example version with a release that has been independently reviewed.

2. Use a lockfile and verified registry integrity hash so that installation fails if package contents differ from the reviewed artifact.

3. Verify and document the relationship between UPLO and the @agentdocs1 package namespace, including the authoritative publisher and repository.

4. Avoid npx -y for security-sensitive first-time execution where practical. Install the reviewed package through a controlled deployment process and execute the locally pinned binary.

5. Run the MCP server in a sandbox or container with restricted filesystem, process, and outbound-network access.

6. Issue a dedicated, short-lived API token with only the minimum read or tool permissions required by this skill. Do not reuse administrative or broadly privileged credentials.

7. Restrict token use to expected origins or workloads where supported, rotate it regularly, and monitor for anomalous queries or data exports.

8. Update README.md to use the same pinned and verified installation procedure so users are not directed to reproduce the unsafe configuration.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file advertises the export_org_context tool as providing a "Full organizational context snapshot," which suggests exporting potentially sensitive internal knowledge. The README does not include any warning about privacy, confidentiality, or careful handling of exported data despite also mentioning internal/confidential/restricted content elsewhere.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as engineering-document search and structured extraction, but its declared capabilities include exporting organization context and retrieving directives or policies, which exceed the narrowly advertised purpose. This creates a scope mismatch that can lead users or agents to grant access to broader internal data and governance information than they reasonably expect, increasing the risk of oversharing sensitive organizational context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The natural-language metadata brands the skill entirely in English and does not mention any user-selectable language or locale behavior. If the skill is intended for general use, this can amount to an implicit language policy without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This is a manifest file, so vague-trigger review applies. The description presents a broad knowledge-management capability across architecture, API, incident, runbook, and infrastructure documentation, but gives no explicit trigger phrases, scope boundaries, or exclusion conditions, which can make invocation criteria ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.