Uplo Github

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:56 PM UTC
• Version: 1.0.0

Overview

This skill matches its GitHub knowledge-management purpose, but it should be reviewed because it runs an unpinned downloaded MCP server with an API token that can access broad organizational context.

Review before installing. Use a short-lived, least-privilege UPLO token, avoid putting it in shared configs, treat exported organization context as sensitive, and prefer a pinned or otherwise verified MCP server version, ideally run with limited local filesystem and environment access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.json:29
• Finding: Unpinned npm Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `skill.json`, lines 29–34 **Additional Location**: `README.md`, lines 20–22 **Vulnerability Type**: Unpinned runtime dependency and automatic package execution **Risk Level**: Medium ### Vulnerable Code `skill.json`, lines 29–34: ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], ``` `README.md`, lines 20–22: ```json "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { ``` ### Technical Analysis The Skill starts its MCP server with `npx -y @agentdocs1/mcp-server --http`. The `-y` option automatically accepts package installation, while the package reference does not specify an exact version or integrity digest. Consequently, the executable code is resolved from the npm registry at installation or launch time and can change after this Skill has been reviewed. A malicious package update, compromised publisher account, or upstream supply-chain compromise could cause arbitrary package lifecycle or server code to execute without further user confirmation. The MCP process receives sensitive configuration through environment variables, including `API_KEY` and `AGENTDOCS_URL`. A compromised dependency could read those variables in addition to exercising the local privileges of the user running the Skill. ### Attack Path 1. An attacker compromises the npm publisher account or release pipeline for `@agentdocs1/mcp-server`, or otherwise causes a malicious release to become the version selected by npm. 2. A user installs or starts the Skill. 3. `npx -y` resolves and downloads the mutable package release without an interactive confirmation. 4. npm executes package installation hooks or the package entry point under the Agent user's local account. 5. The malicious code reads the `API_KEY` and `AGENTDOCS_URL` environment variables supplied to the MCP process. 6. The code can exfiltrate those values, query organizational data available to ...[truncated 964 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@agentdocs1/mcp-server` to a reviewed, exact version rather than relying on the registry-selected release. 2. Use a committed lockfile and enforce package integrity hashes during installation. 3. Install dependencies during a controlled build or deployment stage instead of downloading them automatically at runtime with `npx -y`. 4. Verify package provenance and signatures where supported, and monitor the dependency for publisher or release anomalies. 5. Run the MCP server in a sandbox or container with restricted filesystem, process, and network access. 6. Supply a short-lived, least-privilege API token limited to the repositories and operations necessary for this Skill. 7. Prevent the MCP process from receiving unrelated environment variables or credentials. 8. Establish an update process that requires security review before changing the pinned package version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

Expect queries about repository ownership and CODEOWNERS mappings, pull request review requirements and approval policies, issue tracking and label conventions, team membership and access permissions, branch protection rules and merge strategies, CI/CD status checks and required workflows, and contribution guidelines and coding standards. Use `search_knowledge` for specific repository or team lookups and `search_with_context` when the question requires understanding how a code change relates to team ownership, review policies, and deployment pipelines.

When presenting GitHub information, include repository names, team handles, and relevant links. For PR workflows, specify required reviewers and checks. For issues, include labels, assignees, and milestone context. Flag any repositories with stale CODEOWNERS files or outdated contribution guidelines. Access tokens and deployment credentials are strictly classified — never surface them regardless of clearance. Identify the responsible team lead or repository maintainer via `find_knowledge_owner`.

Respect classification tiers. Never fabricate github information — only surface what exists in the knowledge base.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to configure a long-lived API key in environment variables and advertises capabilities like exporting full organizational context, but it provides no warning about the sensitivity of that data or safe credential-handling practices. In a GitHub knowledge-management skill, this increases the risk of overbroad data exposure, accidental secret leakage in configs/logs, and misuse of high-value organizational context by downstream agents or users.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This manifest defines a required secret token and configures it to be injected into the MCP server environment and used with an HTTP transport endpoint. The file does not include any warning or disclosure about credential use, remote transmission, or the privacy implications of connecting to an external service.

Static analysis

No suspicious patterns detected.