Uplo Food Safety

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:57 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent food-safety knowledge integration, but it runs an unpinned npm MCP server with an API token and exposes a broad organizational export capability for sensitive records.

Install only if you trust the UPLO instance and the npm package source, can pin or otherwise control the MCP server version, and can issue a least-privilege API token. Disable or restrict full organizational export unless it is required, and rely on server-side access controls, auditing, and redaction for confidential HACCP, compliance, supplier, traceability, and recall records.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: skill.json:26

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: skill.json:26-31 and README.md:19-20
Vulnerability Type: Unpinned third-party dependency executed through npx
Risk Level: High

Affected configuration in skill.json:

json

"mcp": {
  "command": "npx",
  "args": [
    "-y",
    "@agentdocs1/mcp-server",
    "--http"
  ],

Documented installation configuration in README.md:

json

"command": "npx",
"args": ["-y", "@agentdocs1/mcp-server", "--http"],

Technical Analysis

The Skill executes @agentdocs1/mcp-server through npx -y without specifying an exact package version or integrity hash. If the package is not already available locally, npx can retrieve it from the configured npm registry. The -y option suppresses interactive confirmation.

As a result, the code actually executed can change after this Skill has been reviewed. A compromised maintainer account, malicious package release, registry compromise, or unexpected upstream update could cause arbitrary code to run under the privileges of the process hosting the Skill.

The package is also supplied with the configured UPLO service URL and API token through environment variables. Therefore, compromise of the dependency could provide immediate access to credentials and organizational food-safety records.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the dependency publication process.
2. The attacker publishes a malicious version under the existing @agentdocs1/mcp-server package name.
3. A user installs or launches the Skill.
4. npx -y @agentdocs1/mcp-server --http resolves and downloads the malicious package without requesting confirmation.
5. The package executes with the permissions of the Agent process.
6. The malicious package reads API_KEY and AGENTDOCS_URL from its environment.
7. It can use those credentials to query accessible organizational records, tran ...[truncated 721 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, for example @agentdocs1/mcp-server@x.y.z, rather than allowing npm to resolve the current release.
2. Use a lockfile and verify package integrity against an approved cryptographic hash.
3. Remove -y where possible so unexpected package retrieval does not occur without confirmation.
4. Prefer a preinstalled, internally mirrored, or vendored dependency that has passed security review.
5. Configure the package manager to use a trusted registry and apply package provenance verification.
6. Run the MCP server in a sandbox or container with restricted filesystem, process, and outbound-network permissions.
7. Supply a narrowly scoped, short-lived API token limited to the required food-safety dataset and read-only operations where feasible.
8. Monitor dependency releases and rotate the API token immediately if package compromise is suspected.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.json:38

Finding

Full Organizational Context Export Exceeds the Skill's Stated Least-Privilege Scope

Content

View full analysis

Vulnerability Details

File Location: skill.json:38-44 and README.md:43-49
Vulnerability Type: Overbroad MCP data-access capability
Risk Level: Medium

Declared capability in skill.json:

json

"capabilities": [
  "search_knowledge",
  "search_with_context",
  "get_policy",
  "export_org_context",
  "get_directives"
],

Capability description in README.md:

markdown

| Tool | Description |
|------|-------------|
| `search_knowledge` | Semantic search across extracted knowledge |
| `search_with_context` | GraphRAG: vector search + entity resolution + edge traversal |
| `export_org_context` | Full organizational context snapshot |
| `get_directives` | Strategic priorities and directives |
| `find_knowledge_owner` | Find subject matter experts |

Technical Analysis

The Skill is presented as a food-safety knowledge tool for HACCP, regulatory compliance, and traceability tasks. However, it declares export_org_context, which the documentation describes as producing a “Full organizational context snapshot.”

No reviewed instruction limits this export capability to the food_safety pack, requires explicit user approval, or restricts returned fields to records needed for a specific request. Although DEFAULT_PACKS is configured as food_safety, the reviewed files do not establish that this value is an enforceable server-side authorization boundary for export_org_context.

This creates a least-privilege concern: a broad export operation is available even though targeted search operations are sufficient for the stated use cases. Prompt manipulation, an erroneous tool selection, or an overbroad user request could place substantially more organizational information into the Agent context than necessary.

Attack Path

1. The Skill connects to the configured UPLO service using an API token that permits export_org_context.
2. A malicious prompt, externally sourc ...[truncated 1249 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove export_org_context from the Skill unless a documented food-safety workflow strictly requires it.
2. Replace full-context export with narrowly scoped search or record-retrieval operations.
3. Enforce dataset, tenant, classification-tier, and food_safety pack restrictions on the server rather than relying only on prompt instructions or DEFAULT_PACKS.
4. Require explicit user confirmation before any bulk export and display the intended scope and data classifications.
5. Use an API token that cannot access organization-wide export operations.
6. Apply record-level authorization and redact fields unrelated to the current task.
7. Set response-size and record-count limits to prevent accidental bulk disclosure.
8. Audit and alert on bulk-export attempts, including the requesting identity, purpose, record scope, and destination.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises an export_org_context tool that can produce a full organizational context snapshot, but it provides no warning about the sensitivity of that data or the need for authorization, scoping, and redaction. In a food safety and compliance context, such exports may include confidential HACCP plans, FDA compliance records, traceability data, and internal quality control information, increasing the risk of overbroad disclosure or misuse.

Content

No source excerpt is available for this finding.