T08 · Insecure Dependencies
Error
- Location
skill.json:23- Finding
Unpinned MCP Package Is Downloaded and Executed Automatically
- Content
View full analysis
- Remediation
View remediation
Security audit
Uplo Manufacturing
Security checks for vulnerabilities and agentic risk
Overview
This manufacturing knowledge skill is mostly coherent, but it needs review because it runs an unpinned MCP package with an API key and can retrieve broad organizational context.
Install only if you trust the UPLO MCP package source and can provide a narrowly scoped UPLO token. Review whether full organizational export and session-start identity/status retrieval are acceptable for your environment, and prefer a pinned MCP package version plus server-side authorization, auditing, and data-minimization controls.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skill.json:43- Finding
Full Organizational Context Export Exceeds Typical Task Requirements
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:14- Finding
Automatic Retrieval of Identity and Sensitive Operational Context Causes Over-Collection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation frames the package as a narrowly scoped manufacturing knowledge tool, yet the listed tools include organization-wide export and directive/intelligence functions. This mismatch is dangerous because users may underestimate the breadth of accessible data and enable the skill in contexts where broad organizational retrieval should have undergone stronger review and access control.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README presents the skill as manufacturing-focused, but the related capabilities and linked adjacent skills broaden expectations toward general organizational intelligence. That scope expansion can mislead users into granting broader trust or deploying the skill against wider internal data than intended, increasing the chance of unnecessary exposure of sensitive business information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Advertising an
export_org_contexttool as a full organizational context snapshot without any warning about sensitivity, authorization, or data minimization creates a clear data-exposure risk. In a manufacturing environment, such snapshots may include production plans, maintenance histories, quality records, internal directives, and other confidential operational intelligence that could be over-collected or exfiltrated.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest advertises a manufacturing knowledge search skill, but it also requests broader capabilities such as policy retrieval, directive retrieval, and organization-context export. This creates unnecessary privilege expansion and increases the chance that an agent can access or expose data outside the user’s expected manufacturing-record workflow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The export_org_context capability can expose broad organizational data that is not clearly required for searching work orders, inspections, schedules, or maintenance records. In this context, that mismatch is especially risky because manufacturing environments often contain sensitive operational, supplier, quality, and process information that could be over-collected or exfiltrated.
- Content