ClawHub
Back to skill

Security audit

Uplo Hr

Security checks for vulnerabilities and agentic risk

Overview

This HR knowledge skill is purpose-aligned, but it runs an unpinned npm MCP server automatically and exposes sensitive HR search/export capabilities that need careful review.

Review before installing. Use only with a least-privilege UPLO token, restrict it to the HR data and classification levels the user actually needs, and avoid broad exports unless explicitly authorized. Prefer a pinned, reviewed MCP server version or isolated runtime before using this with confidential HR data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
skill.json:22
Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: skill.json, lines 22–23
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

json
"command": "npx",
"args": ["-y", "@agentdocs1/mcp-server", "--http"],

Technical Analysis

The MCP configuration invokes npx with the unversioned package name @agentdocs1/mcp-server. Because no exact version, lockfile, or integrity hash is specified, the package resolved and executed at runtime can differ from the package that existed when the Skill was reviewed.

The -y option automatically accepts installation prompts. As a result, starting the Skill can download and execute third-party package code without an additional user confirmation. npm packages may execute application code and lifecycle behavior with the permissions of the user running the Agent.

This is a supply-chain vulnerability rather than evidence that the current package is malicious. Exploitation requires compromise of the package, its publisher account, or the relevant package-distribution infrastructure, or publication of a malicious future version.

Attack Path

  1. An attacker compromises the npm publisher account, package contents, or package-distribution path for @agentdocs1/mcp-server.
  2. The attacker publishes a malicious version that can be resolved by the unversioned package reference.
  3. A user installs or starts the Skill.
  4. npx -y retrieves the currently resolved package without interactive approval.
  5. The malicious package executes with the privileges of the Agent host user.
  6. The package may read process environment variables, including API_KEY and AGENTDOCS_URL, access files available to that user, interact with the configured UPLO service, or make unauthorized network requests.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the operating-system account running the Agent. The acce ...[truncated 645 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin @agentdocs1/mcp-server to an exact, reviewed version rather than relying on the latest registry resolution.
  • Install the dependency through a committed lockfile and enforce package-integrity verification during deployment.
  • Remove -y where interactive approval is appropriate, although this alone does not eliminate the supply-chain risk.
  • Prefer a preinstalled, reviewed artifact or immutable container image over downloading executable code when the Skill starts.
  • Verify package provenance and signatures where supported, and continuously monitor the package and publisher for compromise.
  • Run the MCP server in a sandbox or container with a read-only filesystem, restricted network egress, and no access to unrelated host files.
  • Use a narrowly scoped, short-lived UPLO token and rotate it if dependency compromise is suspected.
  • Restrict the token to only the HR operations and classification levels required by the Skill.

T08 · Insecure Dependencies

Error
Location
README.md:17
Finding

Installation Documentation Recommends Unpinned Automatic Package Execution

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 17–18
Vulnerability Type: Unsafe dependency installation guidance
Risk Level: High

Vulnerable Code

json
"command": "npx",
"args": ["-y", "@agentdocs1/mcp-server", "--http"],

Technical Analysis

The documented Claude Desktop configuration directs users to execute @agentdocs1/mcp-server through npx without an exact version constraint or integrity verification. The effective executable can therefore change after this repository has been audited. The -y option suppresses installation confirmation, allowing the resolved package to be downloaded and run automatically.

Although this is documentation rather than a local script, users who follow the installation instructions reproduce the insecure runtime configuration. The repository contains no lockfile, checksum, vendored implementation, or other mechanism that binds execution to reviewed package contents.

Attack Path

  1. An attacker compromises the npm package, publisher account, or package-distribution infrastructure.
  2. A malicious package release becomes the version resolved for @agentdocs1/mcp-server.
  3. A user copies the documented configuration into Claude Desktop.
  4. Starting the MCP integration invokes npx -y.
  5. The malicious release is downloaded and executed without a confirmation prompt.
  6. Code runs in the Claude Desktop user's context and may access the configured API key, available HR data, local resources, and permitted network destinations.

Impact Assessment

Exploitation may result in arbitrary code execution with the privileges of the user running Claude Desktop or the associated Agent process. A malicious dependency could steal the UPLO token, query HR records within that token's authorization scope, tamper with returned HR guidance, read accessible local files, or communicate data to external systems.

No evidence in the audited repository establi ...[truncated 130 chars]

Remediation
View remediation

Remediation Suggestions

  • Update the example to reference an exact audited package version.
  • Provide a reproducible installation process backed by a committed lockfile and integrity metadata.
  • Document package provenance verification and supported secure upgrade procedures.
  • Avoid recommending npx -y for mutable packages; require deliberate review before dependency upgrades.
  • Recommend execution in an isolated environment with restricted filesystem access and network egress.
  • Instruct users to create a least-privilege UPLO token instead of reusing an administrative or broadly scoped credential.
  • Publish verified checksums or signed immutable artifacts and require validation before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README markets broad search across employee handbooks, org charts, company policies, benefits documentation, and onboarding materials without any visible warning about sensitive HR data handling, access controls, or privacy obligations. In an HR context, this materially increases the risk of misuse, over-collection, or accidental disclosure of personally sensitive employee information because users may treat the tool as safe for unrestricted querying and ingestion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented export_org_context capability enables a full organizational context snapshot, which could include sensitive internal structures, employee relationships, directives, or restricted HR knowledge, yet the README provides no warning about disclosure risk or authorization requirements. In this skill's HR setting, an export feature is especially dangerous because it can convert scoped search access into bulk exfiltration of high-value internal data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.