中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:18 hr ago Rescan
15 /100
uplo-consulting
AI-powered consulting knowledge management. Search engagement records, methodology frameworks, deliverable templates, and best practices with structured extraction.
This is a legitimate consulting knowledge management MCP skill with no malicious code or hidden behavior. Minor supply chain concern exists due to unpinned npx execution for the MCP server dependency.
Skill Nameuplo-consulting
Duration41.8s
Enginepi
✓
Safe to install
Consider pinning the @agentdocs1/mcp-server version (e.g., @agentdocs1/[email protected]) in skill.json to prevent unexpected updates. Otherwise, the skill is safe to use.

Findings 1 items

Severity Finding Location
Low
Unpinned MCP server dependency Supply Chain
The skill uses 'npx -y @agentdocs1/mcp-server' without specifying a version. This means different versions could be executed on different runs, potentially introducing malicious code via a compromised package or dependency.
"command": "npx",
"args": ["-y", "@agentdocs1/mcp-server", "--http"]
→ Pin to a specific version: npx -y @agentdocs1/[email protected] or however the package is versioned
 skill.json:19
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No filesystem access declared or needed
Network READ READ ✓ Aligned MCP server communicates with UPLO instance via HTTP transport
Shell NONE WRITE ✓ Aligned Uses npx to execute MCP server (shell:WRITE), but this is declared in skill.json…
Environment NONE READ ✓ Aligned Reads AGENTDOCS_URL and API_KEY from config, which is necessary for MCP authenti…
Skill Invoke READ READ ✓ Aligned MCP tools (search_knowledge, export_org_context, etc.) are declared and document…
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser access
Database NONE NONE — Database access goes through MCP server to UPLO service
10 findings
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/ClawHub-uplo-consulting-blue
README.md:5
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-consulting
README.md:5
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/MCP-21_tools-green
README.md:6
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/schemas-4-orange
README.md:7
🔗
Medium External URL 外部 URL
https://uplo.ai/schemas
README.md:7
🔗
Medium External URL 外部 URL
https://your-instance.uplo.ai
README.md:24
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-professional-services
README.md:60
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-knowledge-management
README.md:61
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/uplo-accounting
README.md:62
🔗
Medium External URL 外部 URL
https://app.uplo.ai
skill.json:17

File Tree

4 files · 11.0 KB · 227 lines
Markdown 3f · 178L JSON 1f · 49L
├─ 📝 identity-patch.md Markdown 9L · 1.7 KB
├─ 📝 README.md Markdown 70L · 2.8 KB
├─ 📋 skill.json JSON 49L · 1.2 KB
└─ 📝 SKILL.md Markdown 99L · 5.3 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
@agentdocs1/mcp-server latest (unpinned) npm No Version not pinned - uses npx -y without version specifier

Security Positives

✓ No scripts or executable code included in the skill package
✓ All capabilities are clearly documented in SKILL.md
✓ API key is used only for legitimate UPLO service authentication
✓ No credential harvesting or exfiltration detected
✓ No obfuscated code or base64 execution
✓ No attempts to access sensitive local files (~/.ssh, ~/.aws, .env)
✓ Identity patch is legitimate persona modification for consulting context
✓ No reverse shell, C2, or data theft indicators