Uplo Hospitality

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:47 PM UTC
• Version: 1.0.0

Overview

This hospitality knowledge skill is coherent, but it should be reviewed because it can run an unpinned third-party MCP server with an API token and exposes broad organizational export capability.

Install only if you trust UPLO and the npm package source, use a least-privilege and rotatable UPLO token, prefer pinning or otherwise controlling the MCP server version, and restrict full organizational exports to authorized users and approved business needs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.json:25

Finding

Automatic Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: skill.json:25-35
Additional Location: README.md:14-27
Vulnerability Type: Unpinned runtime dependency and automatic remote package execution
Risk Level: Medium

Vulnerable Code

json

"mcp": {
  "command": "npx",
  "args": [
    "-y",
    "@agentdocs1/mcp-server",
    "--http"
  ],
  "env": {
    "AGENTDOCS_URL": "${config.agentdocs_url}",
    "API_KEY": "${config.api_key}",
    "DEFAULT_PACKS": "hospitality"
  },
  "transport": "http",
  "url": "${config.agentdocs_url}/mcp"
}

The installation example in README.md:14-27 documents the same unsafe execution pattern:

json

{
  "mcpServers": {
    "uplo-hospitality": {
      "command": "npx",
      "args": ["-y", "@agentdocs1/mcp-server", "--http"],
      "env": {
        "AGENTDOCS_URL": "https://your-instance.uplo.ai",
        "API_KEY": "your-api-key",
        "DEFAULT_PACKS": "hospitality"
      }
    }
  }
}

Technical Analysis

The configuration invokes npx with the -y option and a package name that has no exact version or integrity constraint. As a result, the npm registry may be contacted at runtime to resolve, download, and execute the version currently selected for @agentdocs1/mcp-server.

Because the effective executable is not pinned, locked, or included in this repository, its behavior can change after this Skill has been reviewed. The downloaded process runs with the operating-system privileges of the Agent user and receives the configured AGENTDOCS_URL and API_KEY environment variables. There is no repository lockfile, vendored implementation, checksum, or other integrity mechanism establishing which package contents will execute.

This is a supply-chain weakness rather than evidence that the current package is malicious. Exploitation would require compromise or malicious modification of the dependency, its maintainer accoun ...[truncated 1568 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example:

   json

   "args": [
     "-y",
     "@agentdocs1/mcp-server@X.Y.Z",
     "--http"
   ]
   

2. Install the dependency through a committed lockfile and use deterministic installation such as npm ci. Avoid downloading executable dependencies each time the Skill starts.

3. Verify npm package provenance and integrity. Record the expected package digest and reject artifacts that do not match the reviewed release.

4. Prefer a locally installed and audited executable over implicit runtime retrieval through npx.

5. Run the MCP server in a sandbox or container with restricted filesystem access, outbound network controls, and no unnecessary operating-system privileges.

6. Use a least-privilege UPLO token limited to the required tenant, operations, classifications, and datasets. Ensure that the token is short-lived and rotatable.

7. Prevent credentials from appearing in logs, crash reports, child-process listings, or diagnostic output. Rotate the API token immediately if dependency compromise is suspected.

8. Add dependency monitoring and require security review before updating the pinned package version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises an export_org_context tool as a 'Full organizational context snapshot' without any surrounding warning, scope limitation, or access-control caveat. In a hospitality knowledge-management context, organizational context can include internal procedures, guest-service operations, proprietary processes, and potentially sensitive business information, so normalizing broad export capability increases the risk of overexposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly promotes export_org_context as providing a "complete operational blueprint of the property" without any warning about sensitivity, least-privilege access, approval requirements, or data-minimization constraints. In a hospitality context, that export could aggregate sensitive operational procedures, vendor data, financial guidance, and internal property details, making overbroad disclosure or exfiltration easier if invoked by an unauthorized or over-permissioned user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This manifest requires an api_key secret and configures an HTTP MCP endpoint using that credential, but the file provides no warning about how the token will be used or transmitted. For manifest files, SQP-2 does not apply, but the missing-warning concern is still visible in the natural-language configuration descriptions and transport setup relevant to user understanding of sensitive operations.

Content

No source excerpt is available for this finding.