Uplo Operations

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:00 PM UTC
• Version: 1.0.0

Overview

The skill matches its stated operations-knowledge purpose, but it runs an unpinned third-party npm MCP server with a sensitive UPLO token and can expose broad organizational context, so users should review it carefully before installing.

Install only if you trust UPLO and the npm package source for `@agentdocs1/mcp-server`. Use a least-privilege UPLO MCP token, pin or otherwise control the MCP server version where possible, run it in a restricted environment, and avoid full organizational exports or persistent logs unless the user is authorized and the content has been minimized and redacted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: skill.json:21

Finding

Automatic Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: skill.json:21-30; duplicated in installation guidance at README.md:20-27
Vulnerability Type: Unpinned third-party dependency automatically downloaded and executed
Risk Level: High

Vulnerable Code

skill.json:21-30:

json

"command": "npx",
"args": [
  "-y",
  "@agentdocs1/mcp-server",
  "--http"
],
"env": {
  "AGENTDOCS_URL": "${config.agentdocs_url}",
  "API_KEY": "${config.api_key}",
  "DEFAULT_PACKS": "operations"
}

README.md:20-27:

json

"uplo-operations": {
  "command": "npx",
  "args": ["-y", "@agentdocs1/mcp-server", "--http"],
  "env": {
    "AGENTDOCS_URL": "https://your-instance.uplo.ai",
    "API_KEY": "your-api-key",
    "DEFAULT_PACKS": "operations"
  }

Technical Analysis

The skill launches @agentdocs1/mcp-server with npx -y without specifying an exact package version or verifying package integrity. The -y option suppresses confirmation, allowing npm to download and execute the currently resolved package release automatically.

Consequently, the code executed by the skill can change after the skill itself has been audited. The repository contains no vendored server source, lockfile, integrity hash, or provenance information that would allow the effective MCP server implementation to be independently verified.

The MCP process also receives API_KEY and AGENTDOCS_URL through its environment. Any code executed by the dependency can read those values. This does not establish that the current package is malicious, but it creates a significant supply-chain exposure if the npm package, publisher account, dependency tree, or package distribution infrastructure is compromised.

Attack Path

1. An attacker compromises the npm publisher account, package distribution channel, or a transitive dependency used by @agentdocs1/mcp-server.
2. The attacker publishes a malicious release that remains ...[truncated 1325 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP server to a reviewed, exact version, for example:

   json

   "args": [
     "-y",
     "@agentdocs1/mcp-server@1.2.3",
     "--http"
   ]
   

   Do not use version ranges or tags such as latest.

2. Prefer installing dependencies through a committed lockfile with npm integrity metadata instead of downloading them dynamically whenever the skill starts.

3. Verify package provenance and signatures where supported. Publish a link to the corresponding source code and build artifacts so the executable package can be independently audited.

4. Remove automatic confirmation through -y where operationally feasible. Require an explicit installation or upgrade step before executing a newly resolved package version.

5. Run the MCP server in a restricted sandbox or container with:

   • A read-only filesystem where possible.
   • No access to unrelated user files.
   • Restricted outbound network destinations.
   • No privileged operating-system capabilities.
   • Resource and process limits.

6. Provide a narrowly scoped, short-lived API token limited to required operations and organizational data. Do not reuse administrative or broadly privileged credentials.

7. Monitor and rotate the API token, maintain dependency vulnerability scanning, and require review before upgrading the pinned package version.

8. Apply the same pinned-version configuration to both skill.json and the example in README.md so users are not instructed to reproduce the unsafe setup.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file advertises semantic search across extracted knowledge and a 'Full organizational context snapshot' export, while also referencing confidential and restricted data classifications elsewhere. The description does not include any user-facing warning about privacy, sensitive data handling, or the impact of exporting broad organizational context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly recommends export_org_context, which can aggregate teams, systems, processes, and interconnections into a single snapshot without any caution about data minimization, authorization checks, or redaction. In an operations context, that export may expose sensitive internal structure and operational dependencies that increase insider misuse risk or broaden the impact of prompt-induced overcollection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction to use log_conversation after significant operational changes encourages persistent recording of rationale and outcomes without warning that logs may capture sensitive operational plans, incident details, vendor issues, or system-change context. In this skill's domain, those records could create a durable repository of high-value operational intelligence if logging is overbroad or accessible beyond need-to-know.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest launches an external package via npx and connects over HTTP transport to a remote MCP endpoint, but the skill provides no user-facing disclosure that installation-time code execution and network access will occur. This is risky because users may unknowingly grant a third-party package access to sensitive operational data and credentials, and npx -y increases supply-chain exposure by fetching and executing code at runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill requires a secret api_key and injects it into the MCP server environment, but the manifest does not clearly disclose how that credential is used, where it is sent, or what scope it grants. In an operations-focused skill with capabilities like export_org_context, this increases the chance of over-trusting the integration and exposing sensitive internal data to a remote service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.