Uplo Energy

This skill appears to be a client for an UPLO knowledge base and legitimately needs an UPLO URL and API key — but the package has three red flags you should resolve before installing: 1) Registry metadata vs manifest mismatch: the registry claims no required env vars, yet skill.json requires agentdocs_url and api_key. Treat the skill as requiring credentials until you verify otherwise. 2) Dynamic npm execution: the skill manifest runs `npx @agentdocs1/mcp-server`. That will fetch and execute a remote npm package at runtime. Verify the package name, its publisher, and inspect its source (or ask the vendor for a signed release) before allowing execution. 3) Unknown origin/homepage: the skill's source/homepage fields are empty even though README references uplo.ai. Verify the publisher identity (is this the official UPLO distribution?) and prefer skills with a clear source and release artifacts. Practical steps: - Confirm the publisher and check the npm package (@agentdocs1/mcp-server) source and recent versions. - Only provide an API key scoped with the minimum permissions and with an expiry/rotation policy, and point AGENTDOCS_URL to a trusted domain (prefer your organization's instance). - If possible, sandbox the skill’s MCP process or audit network activity when first running it. - If you need stronger assurance, ask the maintainer to update registry metadata to declare required env vars and provide a pinned, reviewable install artifact rather than implicit npx execution. If you cannot verify the package provenance or the publisher, treat this skill as higher-risk and do not provide sensitive credentials or CEII data to it.