Security audit

Uplo Healthcare

Security checks for vulnerabilities and agentic risk

Overview

This healthcare knowledge skill is not clearly malicious, but it asks for sensitive organizational access with ambiguous PHI boundaries, bulk export capability, and runtime execution of an unpinned npm package.

Install only after confirming this skill is connected to an authorized UPLO instance with least-privilege healthcare access. Require a pinned, reviewed MCP server version, restrict or disable full context export unless needed, and make PHI, credentialing, peer-review, and incident-investigation boundaries explicit before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: skill.json:26
Finding: Unpinned npm Dependency Is Downloaded and Executed Without Confirmation## Vulnerability Details **File Location**: `skill.json:26-32`; duplicated installation pattern in `README.md:17-28` **Vulnerability Type**: Supply-chain exposure through automatic execution of an unpinned third-party package **Risk Level**: High ### Vulnerable Code `skill.json:26-32`: ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], ``` `README.md:17-28`: ```json { "mcpServers": { "uplo-healthcare": { "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { "AGENTDOCS_URL": "https://your-instance.uplo.ai", "API_KEY": "your-api-key", "DEFAULT_PACKS": "healthcare" } } } } ``` ### Technical Analysis The Skill launches `@agentdocs1/mcp-server` through `npx -y` without specifying an exact package version or integrity digest. If the package is absent locally, `npx` can retrieve the currently resolved version from the configured npm registry. The `-y` option suppresses the normal installation confirmation. Consequently, the code executed when the Skill starts is not immutable and can differ from the code that existed when this project was reviewed. A compromised npm publisher account, malicious package release, registry compromise, or unsafe registry substitution could introduce attacker-controlled code. Because npm packages can execute JavaScript and lifecycle behavior with the privileges of the invoking user, this is a direct supply-chain execution boundary. The README reproduces the same unsafe configuration for users, while `skill.json` makes it part of the Skill's operational configuration. ### Attack Path 1. An attacker compromises the `@agentdocs1/mcp-server` publisher account, its release pipeline, or a registry trusted by the target environment. 2. The attacker publishes a malicious version that resolves when no explicit version is reques ...[truncated 1313 chars]
Remediation: ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, for example `@agentdocs1/mcp-server@X.Y.Z`; do not use version ranges or distribution tags. 2. Install dependencies during a controlled build or deployment phase rather than downloading them dynamically whenever the Skill starts. 3. Commit and enforce a lockfile containing registry-resolved integrity hashes. Use deterministic installation such as `npm ci`. 4. Configure the package manager to use an explicitly trusted registry and reject unexpected registry overrides. 5. Verify package provenance, signatures, and integrity metadata in CI before deployment. 6. Remove `-y` from interactive setup paths where automatic approval is unnecessary. 7. Run the MCP server in a sandbox or dedicated low-privilege account with narrowly restricted filesystem and network access. 8. Provide only the minimum-scope API token required for supported operations and rotate it if dependency compromise is suspected. 9. Update both `skill.json` and the README example so documentation does not instruct users to restore the unsafe behavior. 10. Establish dependency monitoring and require security review before changing the pinned package version.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest/metadata says the skill can search clinical notes, lab results, prescriptions, and patient pathways with structured extraction, while the body of the skill says it does not store or provide access to individual patient health records and only returns organizational reference materials. This security-relevant mismatch can cause an orchestrator or user to invoke the skill for PHI-bearing, patient-specific tasks it is not supposed to handle, creating unsafe data routing, privacy expectation failures, and potential HIPAA exposure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README promotes searching clinical notes, lab results, prescriptions, and patient pathways, which are highly sensitive healthcare data categories, but provides no privacy, compliance, access-control, or data-handling warnings. In a healthcare context, omission of safeguards can encourage unsafe deployment or casual exposure of PHI, increasing the risk of regulatory violations and unauthorized disclosure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Advertising an `export_org_context` capability without clearly warning that it may expose a broad snapshot of organizational knowledge creates a real risk of mass data disclosure. In this skill, the danger is amplified because the exported context may include healthcare-related records and other sensitive internal information, making overbroad access especially harmful.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill presents a broad healthcare knowledge-search capability but does not define hard activation boundaries, despite operating in a domain where patient-specific, privileged, and regulated content is adjacent to allowed organizational documents. Ambiguous invocation scope increases the chance the agent will use this skill for inappropriate requests, including PHI, peer review, credentialing, or incident-investigation material that may require different controls.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The usage examples include areas close to highly sensitive records—such as root cause analysis summaries, credentialing criteria, and cited deficiencies—without explicit exclusions for patient-specific or protected-record requests. In a healthcare setting, this omission is more dangerous because users may reasonably infer that adjacent protected content is in scope, leading to disclosure of PHI or legally privileged peer-review and incident-investigation information.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The manifest explicitly advertises access to highly sensitive healthcare information such as clinical notes, lab results, prescriptions, and patient pathways, but it does not present any user-facing warning, consent language, or privacy/data-handling disclosure. In a healthcare context, this increases the risk that users authorize broad PHI access without understanding retention, transmission, or compliance implications, which can lead to privacy violations and regulatory exposure.

Static analysis

No suspicious patterns detected.