中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：19 小时前 重新扫描
5 /100
uplo-accounting
AI-powered accounting knowledge management. Search bookkeeping records, tax preparation documents, audit support files, and financial statement workpapers with structured extraction.
This is a legitimate accounting knowledge management skill using the MCP framework with a documented UPLO backend. No malicious behavior, hidden functionality, or credential harvesting was found.
技能名称uplo-accounting
分析耗时40.9s
引擎pi
✓
可以安装
No action needed. The skill is safe for use. Consider pinning the @agentdocs1/mcp-server version in skill.json for reproducible builds.

安全发现 1 项

严重性 安全发现 位置
低危
Unversioned npm dependency 供应链
The @agentdocs1/mcp-server package is pulled without a pinned version. While this is common for MCP skills, it means the exact code executed could change over time. Using 'npx -y' bypasses interactive confirmation.
"command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"]
→ Pin the MCP server version (e.g., @agentdocs1/[email protected]) and review the package's provenance before deployment in sensitive environments.
 skill.json:26
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No filesystem access declared or inferred from code
网络访问 READ READ ✓ 一致 MCP server connects to user-configured UPLO instance URL; declared in skill.json
命令执行 NONE WRITE ✓ 一致 skill.json line 26: npx command is declared and controlled via config
环境变量 NONE NONE — No environment variable iteration or sensitive key scanning
技能调用 READ READ ✓ 一致 MCP tools declared in capabilities array of skill.json
剪贴板 NONE NONE — No clipboard access observed
浏览器 NONE NONE — No browser access
数据库 NONE NONE — No database access
10 项发现
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/ClawHub-uplo-accounting-blue
README.md:5
🔗
中危 外部 URL 外部 URL
https://clawhub.com/skills/uplo-accounting
README.md:5
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/MCP-21_tools-green
README.md:6
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/schemas-5-orange
README.md:7
🔗
中危 外部 URL 外部 URL
https://uplo.ai/schemas
README.md:7
🔗
中危 外部 URL 外部 URL
https://your-instance.uplo.ai
README.md:24
🔗
中危 外部 URL 外部 URL
https://clawhub.com/skills/uplo-finance
README.md:60
🔗
中危 外部 URL 外部 URL
https://clawhub.com/skills/uplo-knowledge-management
README.md:61
🔗
中危 外部 URL 外部 URL
https://clawhub.com/skills/uplo-agriculture
README.md:62
🔗
中危 外部 URL 外部 URL
https://app.uplo.ai
skill.json:17

目录结构

4 文件 · 7.1 KB · 185 行
Markdown 3f · 136L JSON 1f · 49L
├─ 📝 identity-patch.md Markdown 9L · 1.7 KB
├─ 📝 README.md Markdown 70L · 2.7 KB
├─ 📋 skill.json JSON 49L · 1.2 KB
└─ 📝 SKILL.md Markdown 57L · 1.5 KB

依赖分析 1 项

包名版本来源已知漏洞备注
@agentdocs1/mcp-server * npm 否 Version not pinned; pulled dynamically via npx -y

安全亮点

✓ No executable scripts bundled in the package — behavior is entirely defined by the remote MCP server
✓ SKILL.md accurately describes the skill's capabilities with no doc-to-code mismatch
✓ identity-patch.md is straightforward context/injection for the accounting domain, consistent with MCP framework design
✓ No credential harvesting or data exfiltration logic present in any file
✓ No obfuscated code, base64 payloads, or anti-analysis techniques
✓ API key is scoped to the user's own UPLO instance (not shared externally)
✓ No access to sensitive local paths (~/.ssh, ~/.aws, .env, etc.)
✓ Classification tier handling is declared and relevant to the accounting domain