Uplo Facilities

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:55 PM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned for facilities knowledge search, but it runs an unpinned remote npm MCP server with a secret token and can expose broad organizational facilities context.

Install only if you trust UPLO and the @agentdocs1 npm package supply chain. Use a narrowly scoped UPLO token, prefer a pinned and reviewed MCP server version, restrict endpoint/network access where possible, and treat full organizational exports as sensitive internal data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.json:26

Finding

Automatic Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: skill.json:26-31 and README.md:19-24
Vulnerability Type: Unpinned dependency and automatic remote package execution
Risk Level: Medium

Vulnerable Code

From skill.json:26-31:

json

"mcp": {
  "command": "npx",
  "args": [
    "-y",
    "@agentdocs1/mcp-server",
    "--http"
  ],

The equivalent installation configuration appears in README.md:19-24:

json

"uplo-facilities": {
  "command": "npx",
  "args": ["-y", "@agentdocs1/mcp-server", "--http"],
  "env": {
    "AGENTDOCS_URL": "https://your-instance.uplo.ai",
    "API_KEY": "your-api-key",

Technical Analysis

The skill starts @agentdocs1/mcp-server through npx -y without specifying an exact package version or verifying package integrity. If the package is not already available locally, npx can retrieve it from the configured npm registry. The -y option suppresses the normal installation confirmation.

Consequently, the code executed at skill startup can change independently of the reviewed skill files. There is no lockfile, integrity hash, vendored implementation, or other mechanism in the audited project that binds execution to a previously reviewed release.

The downloaded MCP server also receives the configured AGENTDOCS_URL and secret API_KEY through environment variables. Although no malicious behavior was found in the reviewed files, the external server implementation is absent from the project and could not be audited as part of this assessment.

Attack Path

1. An attacker compromises the npm package maintainer account, package publication process, registry path, or an upstream dependency used by @agentdocs1/mcp-server.
2. The attacker publishes a modified package version containing malicious startup code.
3. A user installs or starts this skill.
4. The configuration invokes npx -y @agentdocs1/mcp-server --http.
5. Because no exact ve ...[truncated 1083 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @agentdocs1/mcp-server to a reviewed exact version rather than resolving the latest available release:

   json

   "args": [
     "-y",
     "@agentdocs1/mcp-server@1.2.3",
     "--http"
   ]
   

2. Use a lockfile and retain npm integrity metadata. Enforce reproducible installation with npm ci rather than downloading a potentially different package each time the skill starts.

3. Remove automatic npx -y installation from the runtime path. Install dependencies during a controlled build or deployment stage after package review and signature or integrity verification.

4. Audit and monitor the package itself, its transitive dependencies, maintainer changes, and published release provenance. Prefer signed releases and trusted registries.

5. Run the MCP server in a restricted container or sandbox with minimal filesystem access, a read-only root filesystem where practical, limited outbound network access, and no unrelated environment variables.

6. Issue a narrowly scoped API token that can access only the facilities data and operations required by this skill. Avoid granting administrative, cross-tenant, or unrestricted export permissions.

7. Store the API token in an appropriate secret manager, rotate it regularly, redact it from logs, and revoke it immediately if package compromise is suspected.

8. Apply outbound network allowlisting so the server can communicate only with the intended UPLO instance and essential verified package infrastructure during controlled installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises an export_org_context capability described as a full organizational context snapshot, but provides no warning about the sensitivity of the data that may be included or the access controls required to use it safely. In a facilities knowledge system, such exports could expose building records, maintenance details, vendor documentation, and other internal operational data that materially increase privacy, security, and reconnaissance risk if mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest configures use of a secret API key and an outbound HTTP-based MCP connection to a remote service, but the file provides no user-facing disclosure about what data may be sent off-platform or how credentials are used. In a facilities knowledge skill, queries and retrieved records may contain sensitive building, maintenance, vendor, or occupancy information, so silent transmission to an external endpoint creates a meaningful data exposure and trust risk even if TLS is used.

Content

No source excerpt is available for this finding.