Scan Report
5 /100
uplo-clinical
AI-powered clinical operations intelligence spanning pharmaceutical development and healthcare delivery
UPLO Clinical is a legitimate clinical operations knowledge management skill that connects to a documented UPLO MCP server via standard configuration—no executable scripts, no shell access, and no suspicious behaviors beyond expected SaaS connectivity.
Safe to install
Approve for use. The skill is a pure documentation/configuration package for a clinical SaaS product. No action required beyond standard API key security practices.
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Third-party MCP server dependency Supply Chain | skill.json:21 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | No file access in any files |
| Network | READ | READ | ✓ Aligned | skill.json:17 - MCP server connects to configured UPLO instance |
| Shell | NONE | NONE | — | No shell execution found |
| Environment | NONE | NONE | — | No environment variable access |
| Skill Invoke | NONE | NONE | — | No inter-skill invocation |
| Clipboard | NONE | NONE | — | No clipboard access |
| Browser | NONE | NONE | — | No browser automation |
| Database | NONE | NONE | — | No direct DB access |
10 findings
Medium External URL 外部 URL
https://img.shields.io/badge/ClawHub-uplo-clinical-blue README.md:5 Medium External URL 外部 URL
https://clawhub.com/skills/uplo-clinical README.md:5 Medium External URL 外部 URL
https://img.shields.io/badge/MCP-21_tools-green README.md:6 Medium External URL 外部 URL
https://img.shields.io/badge/schemas-15-orange README.md:7 Medium External URL 外部 URL
https://uplo.ai/schemas README.md:7 Medium External URL 外部 URL
https://your-instance.uplo.ai README.md:24 Medium External URL 外部 URL
https://clawhub.com/skills/uplo-healthcare README.md:61 Medium External URL 外部 URL
https://clawhub.com/skills/uplo-knowledge-management README.md:62 Medium External URL 外部 URL
https://clawhub.com/skills/uplo-pharma README.md:63 Medium External URL 外部 URL
https://app.uplo.ai skill.json:17 File Tree
4 files · 11.5 KB · 224 lines Markdown 3f · 175L
JSON 1f · 49L
├─
identity-patch.md
Markdown
├─
README.md
Markdown
├─
skill.json
JSON
└─
SKILL.md
Markdown
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
@agentdocs1/mcp-server | latest | npm | No | Pinned version recommended for production use |
Security Positives
✓ No executable scripts present—pure configuration and documentation
✓ All capabilities are explicitly declared in SKILL.md and skill.json
✓ No shell or filesystem access requests
✓ API key properly marked as secret in skill.json config
✓ No obfuscation or base64-encoded payloads
✓ No credential harvesting beyond what's required for service auth
✓ No suspicious network patterns (only documented UPLO service URLs)
✓ Clear documentation of what the MCP server does
✓ No sensitive files accessed (no .ssh, .env, or config file scanning)