Uplo Logistics

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:00 PM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with logistics knowledge search, but it automatically loads sensitive operational context and runs an unpinned external MCP package with an API token.

Review this before installing in a real logistics environment. Use a narrowly scoped UPLO token, confirm the MCP package source and version, avoid enabling the skill for unrelated sessions, and require explicit approval before exporting org context, logging conversations, or marking records outdated.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: skill.json:27

Finding

Unpinned Third-Party npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: skill.json:27-37; duplicated in installation guidance at README.md:17-29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

skill.json:27-37:

json

"command": "npx",
"args": [
  "-y",
  "@agentdocs1/mcp-server",
  "--http"
],
"env": {
  "AGENTDOCS_URL": "${config.agentdocs_url}",
  "API_KEY": "${config.api_key}",
  "DEFAULT_PACKS": "logistics"
},

README.md:17-29:

json

{
  "mcpServers": {
    "uplo-logistics": {
      "command": "npx",
      "args": ["-y", "@agentdocs1/mcp-server", "--http"],
      "env": {
        "AGENTDOCS_URL": "https://your-instance.uplo.ai",
        "API_KEY": "your-api-key",
        "DEFAULT_PACKS": "logistics"
      }
    }
  }
}

Technical Analysis

The configuration invokes npx -y with @agentdocs1/mcp-server but does not specify an exact package version or integrity hash. Consequently, startup may retrieve and execute whichever release the package registry resolves at that time. The -y option suppresses the interactive installation confirmation.

This creates a mutable dependency execution channel: the effective executable can change after the Skill has been reviewed. A compromised npm publisher account, malicious package release, registry compromise, or unexpected upstream change could result in arbitrary code execution under the account running the Agent.

The child process also receives API_KEY and AGENTDOCS_URL through its environment. A malicious package version could read and exfiltrate those values. This finding does not establish that the current package is malicious; it identifies the unsafe, unpinned execution model.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or another relevant supply-chain component.
2. The attacker publishes a malicious release of `@agentdocs1/ ...[truncated 898 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @agentdocs1/mcp-server to a reviewed, exact version rather than relying on the registry's latest resolution.
2. Install the dependency through a lockfile-controlled deployment process and verify package integrity hashes.
3. Remove automatic -y installation from runtime startup. Install and verify dependencies during a controlled build or provisioning stage.
4. Monitor the pinned package and its transitive dependencies for known vulnerabilities and publisher changes.
5. Run the MCP server in a restricted sandbox or container with minimal filesystem and network permissions.
6. Use a narrowly scoped MCP token, rotate it regularly, and ensure it cannot perform administrative operations.
7. Restrict outbound network access to explicitly required UPLO endpoints so an unexpected package cannot freely exfiltrate credentials.
8. Consider vendoring or internally mirroring a reviewed package artifact and validating its signature or checksum before execution.

other

Warning

• Location: SKILL.md:12

Finding

Automatic Session Initialization Retrieves Sensitive Logistics Context Without Request-Scoped Necessity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-20
Vulnerability Type: other: Excessive Data Access
Risk Level: Medium

Vulnerable Code

markdown

## Session Start

Begin every session by pulling your current logistics context. This surfaces active shipments, pending customs clearances, warehouse capacity alerts, and any flagged carrier performance issues so you can orient before diving into specifics.

use_mcp_tool: get_identity_context use_mcp_tool: search_knowledge query="active shipments and logistics alerts this week"

text

Technical Analysis

The Skill instructs the Agent to retrieve identity context and current logistics records at the beginning of every session. This behavior is unconditional and is not limited to sessions in which the user has requested shipment or logistics information.

The retrieved material can include active shipments, customs-clearance status, warehouse-capacity alerts, and carrier-performance issues. Loading such information into the Agent context without a task-specific need violates data-minimization and least-privilege principles. It unnecessarily increases the amount of confidential operational information exposed to the model and any other components involved in processing its context.

The project also recommends organizational-context export and conversation logging elsewhere, but those operations are presented as contextual workflows rather than mandatory startup actions. The confirmed issue here is the unconditional session-start retrieval.

No evidence shows that the Skill bypasses server-side authorization. The accessible scope remains dependent on the configured MCP token and UPLO access controls.

Attack Path

1. A user starts any session with the Skill enabled, including a session whose request does not require current logistics records.
2. The Skill instructs the Agent to call get_identity_context.
3. It then instructs the Agent to ...[truncated 833 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove unconditional session-start calls to get_identity_context and search_knowledge.
2. Invoke logistics searches only when required by the user's explicit request.
3. Obtain confirmation before retrieving broad identity, organizational, or cross-shipment context.
4. Use narrowly scoped queries and return only fields required for the current task.
5. Redact tracking numbers, personal information, contract details, and customs information unless they are necessary for the requested response.
6. Enforce classification tiers and record-level authorization on the MCP server rather than relying only on Agent instructions.
7. Separate read-only search credentials from credentials capable of exporting, modifying, flagging, or logging organizational information.
8. Apply retention limits and access controls to model traces and logs that may contain logistics results.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file shows users configuring AGENTDOCS_URL and API_KEY, which implies the skill connects to a remote service and uses credentials, but it does not include any warning about sending organizational logistics data to that service or about safeguarding the key. Because the README also advertises searching shipment records, warehouse procedures, fleet data, and customs documentation, the omission affects privacy and system-integrity expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly promotes export_org_context as useful for onboarding external freight brokers or 3PL partners, but provides no warning, access check guidance, or data-minimization constraint around exporting potentially sensitive internal organizational, trade-lane, and reporting information. In a logistics environment, this context can expose internal structure and operational ownership data that could be inappropriately shared or exfiltrated if the assistant follows the workflow too broadly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.