Uplo Insurance

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:47 PM UTC
• Version: 1.0.0

Overview

The skill fits its insurance knowledge-management purpose, but it automatically runs an unpinned npm MCP server with a sensitive UPLO token, so users should review it before use.

Before installing, verify and pin the MCP server package version or run a previously audited local build, use a narrowly scoped UPLO token, and run the MCP server in a contained environment. Only connect authorized insurance datasets, and review access controls for full organizational exports and sensitive claims, actuarial, reinsurance, and regulatory content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: skill.json:27

Finding

Automatic Execution of an Unpinned npm Dependency

Content

View full analysis

Vulnerability Details

File Location: skill.json:27-36 and README.md:20-22
Vulnerability Type: Unpinned third-party package installed and executed automatically
Risk Level: High

The Skill launches an npm package using npx -y without specifying an exact version, lockfile, checksum, or other integrity constraint.

Vulnerable configuration in skill.json:

json

"mcp": {
  "command": "npx",
  "args": [
    "-y",
    "@agentdocs1/mcp-server",
    "--http"
  ],
  "env": {
    "AGENTDOCS_URL": "${config.agentdocs_url}",
    "API_KEY": "${config.api_key}",
    "DEFAULT_PACKS": "insurance"
  },
  "transport": "http",
  "url": "${config.agentdocs_url}/mcp"
}

The same unsafe installation pattern is documented in README.md:

json

"uplo-insurance": {
  "command": "npx",
  "args": ["-y", "@agentdocs1/mcp-server", "--http"],
  "env": {
    "AGENTDOCS_URL": "https://your-instance.uplo.ai",
    "API_KEY": "your-api-key",
    "DEFAULT_PACKS": "insurance"
  }
}

Technical Analysis

npx can retrieve a package from the configured npm registry when it is not already installed locally. The -y option suppresses the interactive installation confirmation. Because @agentdocs1/mcp-server has no exact version constraint, the effective executable can change after the Skill has been reviewed.

This creates a supply-chain trust boundary in which a future package release, compromised npm maintainer account, registry compromise, or malicious dependency introduced into the package can result in arbitrary code execution. The launched process is explicitly provided with API_KEY and AGENTDOCS_URL, making those values accessible to any code executing inside the dependency.

The audit did not establish that the current package is malicious. The confirmed weakness is the automatic execution of mutable, unpinned third-party code without an integrity-verification mechanism.

...[truncated 1805 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned package reference with an audited exact version, for example @agentdocs1/mcp-server@X.Y.Z; do not use a range or floating tag.
2. Install the dependency during a controlled build step using a committed lockfile containing npm integrity metadata, rather than downloading it dynamically whenever the Skill runs.
3. Use npm ci --ignore-scripts where compatible, and explicitly review any installation scripts that must be enabled.
4. Remove -y so unexpected package installation cannot occur without an explicit decision. Prefer launching a previously installed, verified local binary.
5. Verify package provenance, publisher identity, release signatures, and checksums before approving upgrades. Review transitive dependency changes for every update.
6. Run the MCP server in a sandbox or container with a read-only filesystem, minimal outbound network access, no unnecessary host mounts, and a dedicated unprivileged account.
7. Supply a narrowly scoped, short-lived API token that grants only the knowledge operations required by this Skill. Do not reuse administrative credentials.
8. Prevent child processes and unrelated tools from inheriting the API key where feasible. Rotate the token immediately if dependency compromise is suspected.
9. Update the installation example in README.md so users are not instructed to reproduce the unsafe unpinned npx -y pattern.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises searching policy documents, claims records, underwriting guidelines, and actuarial data, which are likely sensitive business and possibly personal data. It does not include any warning about handling confidential information, privacy considerations, or ensuring authorization before querying or exposing such data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool list includes export_org_context described as a full organizational context snapshot, which could materially affect privacy or system integrity if used improperly. The README provides no warning about the sensitivity of exported content, access restrictions, or the need for user review before exporting.

Content

No source excerpt is available for this finding.