Uplo Environmental

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:52 PM UTC
• Version: 1.0.0

Overview

The skill’s environmental knowledge-management purpose is coherent, but it starts an unpinned external MCP package with a secret API key and exposes broad organizational context export capability.

Review this skill before installing. Use a narrowly scoped UPLO token, confirm your organization accepts the @agentdocs1/mcp-server package source, prefer a pinned and reviewed package version, and restrict bulk context export to authorized users and appropriate data classifications.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: skill.json:27

Finding

Unpinned MCP Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: skill.json:27-32; installation instructions are also documented in README.md:20-23
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

From skill.json:27-32:

json

"command": "npx",
"args": [
  "-y",
  "@agentdocs1/mcp-server",
  "--http"
],

Corresponding configuration from README.md:20-23:

json

"command": "npx",
"args": ["-y", "@agentdocs1/mcp-server", "--http"],

Technical Analysis

The skill starts the external @agentdocs1/mcp-server package through npx -y without specifying an exact version or package integrity value. If the package is not already available in the local npm cache, npx can retrieve it from the configured npm registry. The -y option suppresses the normal installation confirmation and permits the downloaded package to execute automatically.

Because no immutable version is pinned, the effective code executed by the skill can change after this skill package has been reviewed. A compromised maintainer account, malicious package release, registry compromise, or unexpected upstream update could therefore introduce arbitrary code into the MCP server startup path.

The launched process receives the configured API_KEY and the UPLO service endpoint through environment variables. It consequently operates in a security-sensitive context with access to credentials and potentially confidential organizational environmental records.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the relevant package-distribution channel.
2. The attacker publishes a malicious release under the existing @agentdocs1/mcp-server package name.
3. A user installs or starts this skill on a system where the malicious release is selected by the unpinned npx invocation.
4. The -y option allows the package to be downloaded and executed without an interactive appro ...[truncated 1190 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version, for example @agentdocs1/mcp-server@X.Y.Z, rather than resolving an unspecified release.
2. Install the dependency during a controlled build or deployment phase instead of downloading it automatically whenever the skill starts.
3. Use a lockfile and verify npm integrity metadata or an independently maintained checksum before execution.
4. Remove -y where interactive installation is appropriate, so unexpected package retrieval is not silently approved.
5. Restrict package installation to an approved registry and enforce dependency allowlisting or provenance verification.
6. Run the MCP server in a sandbox or isolated container with minimal filesystem and network permissions.
7. Supply a narrowly scoped, short-lived API token that grants only the environmental operations required by this skill.
8. Prevent the MCP child process from inheriting unrelated environment variables and credentials.
9. Monitor and audit package-version changes, MCP authentication activity, and unusually broad knowledge exports.
10. Update the README.md example to use the same pinned and verified dependency configuration so users do not reproduce the unsafe invocation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises an export_org_context tool as providing a full organizational context snapshot, but gives no warning that this may expose large amounts of sensitive internal data to an AI client or downstream integrations. In a knowledge-management skill handling environmental assessments, compliance data, permits, and potentially confidential organizational records, normalizing bulk export without access-control guidance increases the risk of overexposure, accidental leakage, and excessive data sharing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.