Uplo Energy

AI-powered energy sector knowledge management. Search power generation records, grid management data, regulatory filings, and safety protocols with structure...

This skill appears to be a client for an UPLO knowledge base and legitimately needs an UPLO URL and API key — but the package has three red flags you should resolve before installing: 1) Registry metadata vs manifest mismatch: the registry claims no required env vars, yet skill.json requires agentdocs_url and api_key. Treat the skill as requiring credentials until you verify otherwise. 2) Dynamic npm execution: the skill manifest runs `npx @agentdocs1/mcp-server`. That will fetch and execute a remote npm package at runtime. Verify the package name, its publisher, and inspect its source (or ask the vendor for a signed release) before allowing execution. 3) Unknown origin/homepage: the skill's source/homepage fields are empty even though README references uplo.ai. Verify the publisher identity (is this the official UPLO distribution?) and prefer skills with a clear source and release artifacts. Practical steps: - Confirm the publisher and check the npm package (@agentdocs1/mcp-server) source and recent versions. - Only provide an API key scoped with the minimum permissions and with an expiry/rotation policy, and point AGENTDOCS_URL to a trusted domain (prefer your organization's instance). - If possible, sandbox the skill’s MCP process or audit network activity when first running it. - If you need stronger assurance, ask the maintainer to update registry metadata to declare required env vars and provide a pinned, reviewable install artifact rather than implicit npx execution. If you cannot verify the package provenance or the publisher, treat this skill as higher-risk and do not provide sensitive credentials or CEII data to it.

Type: OpenClaw Skill Name: uplo-energy Version: 1.0.0 The uplo-energy skill is a specialized knowledge management tool for the energy sector, designed to interface with the UPLO platform. It uses standard MCP (Model Context Protocol) patterns to provide tools for searching regulatory filings, grid data, and compliance records. While the skill includes high-privilege capabilities like 'export_org_context' and handles sensitive NERC/CEII data, these functions are strictly aligned with its stated purpose of organizational intelligence. No evidence of malicious intent, data exfiltration to unauthorized endpoints, or harmful prompt injection was found in SKILL.md or identity-patch.md.