中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:18 hr ago Rescan
5 /100
uplo-accounting
AI-powered accounting knowledge management. Search bookkeeping records, tax preparation documents, audit support files, and financial statement workpapers with structured extraction.
This is a legitimate accounting knowledge management skill using the MCP framework with a documented UPLO backend. No malicious behavior, hidden functionality, or credential harvesting was found.
Skill Nameuplo-accounting
Duration40.9s
Enginepi
✓
Safe to install
No action needed. The skill is safe for use. Consider pinning the @agentdocs1/mcp-server version in skill.json for reproducible builds.

Findings 1 items

Severity Finding Location
Low
Unversioned npm dependency Supply Chain
The @agentdocs1/mcp-server package is pulled without a pinned version. While this is common for MCP skills, it means the exact code executed could change over time. Using 'npx -y' bypasses interactive confirmation.
"command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"]
→ Pin the MCP server version (e.g., @agentdocs1/[email protected]) and review the package's provenance before deployment in sensitive environments.
 skill.json:26
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No filesystem access declared or inferred from code
Network READ READ ✓ Aligned MCP server connects to user-configured UPLO instance URL; declared in skill.json
Shell NONE WRITE ✓ Aligned skill.json line 26: npx command is declared and controlled via config
Environment NONE NONE — No environment variable iteration or sensitive key scanning
Skill Invoke READ READ ✓ Aligned MCP tools declared in capabilities array of skill.json
Clipboard NONE NONE — No clipboard access observed
Browser NONE NONE — No browser access
Database NONE NONE — No database access
10 findings
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/ClawHub-uplo-accounting-blue
README.md:5
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-accounting
README.md:5
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/MCP-21_tools-green
README.md:6
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/schemas-5-orange
README.md:7
🔗
Medium External URL 外部 URL
https://uplo.ai/schemas
README.md:7
🔗
Medium External URL 外部 URL
https://your-instance.uplo.ai
README.md:24
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-finance
README.md:60
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-knowledge-management
README.md:61
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-agriculture
README.md:62
🔗
Medium External URL 外部 URL
https://app.uplo.ai
skill.json:17

File Tree

4 files · 7.1 KB · 185 lines
Markdown 3f · 136L JSON 1f · 49L
├─ 📝 identity-patch.md Markdown 9L · 1.7 KB
├─ 📝 README.md Markdown 70L · 2.7 KB
├─ 📋 skill.json JSON 49L · 1.2 KB
└─ 📝 SKILL.md Markdown 57L · 1.5 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
@agentdocs1/mcp-server * npm No Version not pinned; pulled dynamically via npx -y

Security Positives

✓ No executable scripts bundled in the package — behavior is entirely defined by the remote MCP server
✓ SKILL.md accurately describes the skill's capabilities with no doc-to-code mismatch
✓ identity-patch.md is straightforward context/injection for the accounting domain, consistent with MCP framework design
✓ No credential harvesting or data exfiltration logic present in any file
✓ No obfuscated code, base64 payloads, or anti-analysis techniques
✓ API key is scoped to the user's own UPLO instance (not shared externally)
✓ No access to sensitive local paths (~/.ssh, ~/.aws, .env, etc.)
✓ Classification tier handling is declared and relevant to the accounting domain