中文 EN

Scan Report

Scan New Files

✓ Low Risk — Risk Score 5/100
Last scan:20 hr ago Rescan
5 /100
uplo-customer-success
AI-powered customer success knowledge management. Search account health data, onboarding records, renewal tracking, and support escalation documentation with structured extraction.
This is a legitimate UPLO customer success knowledge management MCP skill with no malicious indicators - only documentation and configuration files, no executable scripts, and standard MCP protocol usage.
Skill Nameuplo-customer-success
Duration40.9s
Enginepi
✓
Safe to install
This skill is safe to use. Ensure the UPLO instance URL uses HTTPS in production, and follow standard API key rotation practices.

Findings 2 items

Severity Finding Location
Low
External MCP server dependency Supply Chain
The skill uses 'npx -y @agentdocs1/mcp-server' to bootstrap an external MCP server. While this is standard for MCP tools, it downloads code at runtime.
"command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"]
→ Pin the @agentdocs1/mcp-server version in production for reproducibility
 skill.json:13
Info
HTTP URL placeholder in config Doc Mismatch
The configuration example uses an HTTP URL placeholder. Production deployments should use HTTPS.
"agentdocs_url": "https://app.uplo.ai"
→ Ensure production instances use HTTPS endpoints
 skill.json:17
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No filesystem access declared or inferred - MCP tool operates via remote service
Network READ READ ✓ Aligned skill.json:17-18 - HTTP transport to configured UPLO instance URL
Shell NONE NONE — No direct shell execution - only npx for MCP server bootstrap
Environment NONE NONE — Only AGENTDOCS_URL and API_KEY injected for MCP server, not iterated or exfiltra…
Skill Invoke READ READ ✓ Aligned skill.json:21-25 - 5 capabilities declared (search_knowledge, search_with_contex…
10 findings
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/ClawHub-uplo-customer-success-blue
README.md:5
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-customer-success
README.md:5
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/MCP-21_tools-green
README.md:6
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/schemas-4-orange
README.md:7
🔗
Medium External URL 外部 URL
https://uplo.ai/schemas
README.md:7
🔗
Medium External URL 外部 URL
https://your-instance.uplo.ai
README.md:24
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-customer-360
README.md:60
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-knowledge-management
README.md:61
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-accounting
README.md:62
🔗
Medium External URL 外部 URL
https://app.uplo.ai
skill.json:17

File Tree

4 files · 10.8 KB · 217 lines
Markdown 3f · 168L JSON 1f · 49L
├─ 📝 identity-patch.md Markdown 9L · 1.8 KB
├─ 📝 README.md Markdown 70L · 2.8 KB
├─ 📋 skill.json JSON 49L · 1.3 KB
└─ 📝 SKILL.md Markdown 89L · 4.9 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
@agentdocs1/mcp-server latest (unpinned) npm (via npx) No Version not pinned - installed via npx -y at runtime

Security Positives

✓ No executable scripts or code files present - only documentation
✓ No credential harvesting or exfiltration detected
✓ No obfuscation techniques (base64, eval, etc.)
✓ Capabilities are clearly documented and match implementation
✓ Uses standard MCP protocol with HTTP transport
✓ API key is used only for service authentication, not exfiltrated
✓ No sensitive file/path access (SSH, AWS, .env files)
✓ No reverse shell, C2 communication, or data theft patterns