Uplo Accounting

This skill appears to be a legitimate accounting knowledge connector, but there are red flags you should address before installing or providing credentials: - Confirm source and authenticity: the package lists no homepage and the registry owner is opaque; verify this extension actually comes from your vendor or a trusted UPLO provider. - Resolve the metadata mismatch: skill.json requires agentdocs_url and api_key, but the registry display claimed no required credentials — do not ignore the credential requirement. - Restrict the API key: if you provide an API_KEY, ensure it is scoped minimally (read/search only) and revocable. Avoid using org-wide admin keys. - Verify tooling: SKILL.md expects the 'mcporter' CLI and README suggests using 'npx @agentdocs1/mcp-server' (downloads from npm). Only run those tools after vetting the npm package owner and reviewing package contents. - Be cautious with exported data and logging: the skill can export_org_context and log_conversation; verify what conversation metadata is sent and whether that complies with internal data-handling and classification rules. - Testing: first connect to a non-production UPLO instance (or a limited test tenant) to validate behavior and see exactly what data is transmitted. If you cannot confirm the vendor or validate the npm package and API key scope, treat this skill as untrusted and avoid supplying production credentials or sensitive data.