Uplo Nonprofit

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:00 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for nonprofit knowledge management, but it runs an unpinned npm MCP server with an API token while handling sensitive organizational data.

Install only if you trust the UPLO MCP package source and can restrict the API token to the minimum needed permissions. Prefer a pinned, reviewed MCP server version, run it in a constrained environment, and treat searches or organization exports as confidential because they may include donor, board, financial, grant, and compliance records.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: skill.json:24

Finding

Automatic Execution of an Unpinned npm Dependency

Content

View full analysis

Vulnerability Details

File Location: skill.json:24-30; also documented in README.md:17-30
Vulnerability Type: Unpinned third-party package automatically downloaded and executed
Risk Level: High

Vulnerable Code

From skill.json:

json

"mcp": {
  "command": "npx",
  "args": [
    "-y",
    "@agentdocs1/mcp-server",
    "--http"
  ],
  "env": {
    "AGENTDOCS_URL": "${config.agentdocs_url}",
    "API_KEY": "${config.api_key}",
    "DEFAULT_PACKS": "nonprofit"
  },
  "transport": "http",
  "url": "${config.agentdocs_url}/mcp"
}

The same installation pattern is presented in README.md:

json

{
  "mcpServers": {
    "uplo-nonprofit": {
      "command": "npx",
      "args": ["-y", "@agentdocs1/mcp-server", "--http"],
      "env": {
        "AGENTDOCS_URL": "https://your-instance.uplo.ai",
        "API_KEY": "your-api-key",
        "DEFAULT_PACKS": "nonprofit"
      }
    }
  }
}

Technical Analysis

The skill invokes npx with the -y option and a package name that has no exact version constraint. Consequently, npm may download and execute the version currently published under @agentdocs1/mcp-server without prompting the user. The project provides no lockfile, integrity hash, vendored source, or locally reviewable implementation for that dependency.

This creates a supply-chain trust boundary outside the audited project. A compromised registry account, malicious package release, or unsafe future update could change the code executed by the skill after this static review. The launched package also receives API_KEY and AGENTDOCS_URL through its environment, increasing the consequences of dependency compromise.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another relevant part of the package supply chain.
2. The attacker publishes a malicious version under `@agentdocs1/mcp-serve ...[truncated 1448 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an audited exact version, for example @agentdocs1/mcp-server@X.Y.Z, rather than resolving the latest available release.
2. Install the dependency through a committed lockfile and use a deterministic installation mechanism such as npm ci.
3. Enforce package integrity verification through lockfile integrity metadata, trusted provenance, and signature or attestation validation where available.
4. Avoid npx -y for automatic retrieval and execution. Prefer a preinstalled, reviewed binary from a controlled build artifact.
5. Review the dependency's source, transitive dependencies, lifecycle scripts, publisher provenance, and release process before deployment.
6. Run the MCP server in a sandbox or container with restricted filesystem access, network egress controls, no unnecessary host mounts, and a dedicated low-privilege operating-system identity.
7. Issue a narrowly scoped MCP token with only the read or write permissions required by the skill. Do not reuse administrative credentials.
8. Configure short token lifetimes, rotation, revocation, audit logging, and alerts for anomalous access.
9. Update the README configuration example so users are not instructed to execute an unpinned package automatically.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises an export_org_context capability that can expose a full organizational context snapshot, but it does not warn users about the sensitivity of donor records, compliance data, internal reports, or other potentially confidential nonprofit information. In this skill context, broad export functionality increases the risk of over-collection, accidental disclosure, and misuse by downstream AI tools or users who may not understand the privacy and access-control implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly targets highly sensitive nonprofit data, including donor records, board materials, grant documentation, and compliance filings, but it does not warn users about the sensitivity of these records or encourage least-privilege, authorization checks, or careful handling. In this context, omission of a warning increases the likelihood of inappropriate access, over-broad querying, or accidental disclosure of confidential financial, governance, and donor information.

Content

No source excerpt is available for this finding.