Uplo Healthcare

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:47 PM UTC
• Version: 1.0.0

Overview

This healthcare knowledge skill is not clearly malicious, but it asks for sensitive organizational access with ambiguous PHI boundaries, bulk export capability, and runtime execution of an unpinned npm package.

Install only after confirming this skill is connected to an authorized UPLO instance with least-privilege healthcare access. Require a pinned, reviewed MCP server version, restrict or disable full context export unless needed, and make PHI, credentialing, peer-review, and incident-investigation boundaries explicit before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: skill.json:26

Finding

Unpinned npm Dependency Is Downloaded and Executed Without Confirmation

Content

View full analysis

Vulnerability Details

File Location: skill.json:26-32; duplicated installation pattern in README.md:17-28
Vulnerability Type: Supply-chain exposure through automatic execution of an unpinned third-party package
Risk Level: High

Vulnerable Code

skill.json:26-32:

json

"mcp": {
  "command": "npx",
  "args": [
    "-y",
    "@agentdocs1/mcp-server",
    "--http"
  ],

README.md:17-28:

json

{
  "mcpServers": {
    "uplo-healthcare": {
      "command": "npx",
      "args": ["-y", "@agentdocs1/mcp-server", "--http"],
      "env": {
        "AGENTDOCS_URL": "https://your-instance.uplo.ai",
        "API_KEY": "your-api-key",
        "DEFAULT_PACKS": "healthcare"
      }
    }
  }
}

Technical Analysis

The Skill launches @agentdocs1/mcp-server through npx -y without specifying an exact package version or integrity digest. If the package is absent locally, npx can retrieve the currently resolved version from the configured npm registry. The -y option suppresses the normal installation confirmation.

Consequently, the code executed when the Skill starts is not immutable and can differ from the code that existed when this project was reviewed. A compromised npm publisher account, malicious package release, registry compromise, or unsafe registry substitution could introduce attacker-controlled code. Because npm packages can execute JavaScript and lifecycle behavior with the privileges of the invoking user, this is a direct supply-chain execution boundary.

The README reproduces the same unsafe configuration for users, while skill.json makes it part of the Skill's operational configuration.

Attack Path

1. An attacker compromises the @agentdocs1/mcp-server publisher account, its release pipeline, or a registry trusted by the target environment.
2. The attacker publishes a malicious version that resolves when no explicit version is reques ...[truncated 1313 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version, for example @agentdocs1/mcp-server@X.Y.Z; do not use version ranges or distribution tags.
2. Install dependencies during a controlled build or deployment phase rather than downloading them dynamically whenever the Skill starts.
3. Commit and enforce a lockfile containing registry-resolved integrity hashes. Use deterministic installation such as npm ci.
4. Configure the package manager to use an explicitly trusted registry and reject unexpected registry overrides.
5. Verify package provenance, signatures, and integrity metadata in CI before deployment.
6. Remove -y from interactive setup paths where automatic approval is unnecessary.
7. Run the MCP server in a sandbox or dedicated low-privilege account with narrowly restricted filesystem and network access.
8. Provide only the minimum-scope API token required for supported operations and rotate it if dependency compromise is suspected.
9. Update both skill.json and the README example so documentation does not instruct users to restore the unsafe behavior.
10. Establish dependency monitoring and require security review before changing the pinned package version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest/metadata says the skill can search clinical notes, lab results, prescriptions, and patient pathways with structured extraction, while the body of the skill says it does not store or provide access to individual patient health records and only returns organizational reference materials. This security-relevant mismatch can cause an orchestrator or user to invoke the skill for PHI-bearing, patient-specific tasks it is not supposed to handle, creating unsafe data routing, privacy expectation failures, and potential HIPAA exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README promotes searching clinical notes, lab results, prescriptions, and patient pathways, which are highly sensitive healthcare data categories, but provides no privacy, compliance, access-control, or data-handling warnings. In a healthcare context, omission of safeguards can encourage unsafe deployment or casual exposure of PHI, increasing the risk of regulatory violations and unauthorized disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Advertising an export_org_context capability without clearly warning that it may expose a broad snapshot of organizational knowledge creates a real risk of mass data disclosure. In this skill, the danger is amplified because the exported context may include healthcare-related records and other sensitive internal information, making overbroad access especially harmful.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill presents a broad healthcare knowledge-search capability but does not define hard activation boundaries, despite operating in a domain where patient-specific, privileged, and regulated content is adjacent to allowed organizational documents. Ambiguous invocation scope increases the chance the agent will use this skill for inappropriate requests, including PHI, peer review, credentialing, or incident-investigation material that may require different controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage examples include areas close to highly sensitive records—such as root cause analysis summaries, credentialing criteria, and cited deficiencies—without explicit exclusions for patient-specific or protected-record requests. In a healthcare setting, this omission is more dangerous because users may reasonably infer that adjacent protected content is in scope, leading to disclosure of PHI or legally privileged peer-review and incident-investigation information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest explicitly advertises access to highly sensitive healthcare information such as clinical notes, lab results, prescriptions, and patient pathways, but it does not present any user-facing warning, consent language, or privacy/data-handling disclosure. In a healthcare context, this increases the risk that users authorize broad PHI access without understanding retention, transmission, or compliance implications, which can lead to privacy violations and regulatory exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.