Uplo Healthcare

AI-powered healthcare knowledge management. Search clinical notes, care plans, lab results, prescriptions, and patient pathways with structured extraction.

What to check before installing: - Confirm the source: verify the UPLO vendor and the author identity (UPLO / @agentdocs1) and prefer installing only from a trusted internal registry or a vetted vendor page. - Validate configuration mismatch: the registry metadata you received claims no required envs, but skill.json and README require an agentdocs_url and api_key. Clarify which is correct before supplying credentials. - Audit the npm package: skill.json/README indicate usage of an npx command that will fetch @agentdocs1/mcp-server. Inspect that npm package (versioned release, publisher, recent change history) or ask for a pinned, auditable release before allowing runtime fetches. - Use least privilege for credentials: issue an API key scoped only to the capabilities the skill needs (read/search/export) and avoid giving it access to PHI or unrelated services. - Control export actions: treat export_org_context as sensitive. Limit who can invoke exports, require approval/auditing, and verify exported data does not include PHI or overly broad organizational data. - Prefer pinned versions: request that the skill manifest reference a pinned package version (not an implicit latest via npx -y) or allow hosting the MCP server internally. - Logging & auditing: ensure all queries and exports are logged and reviewed; ensure the integration complies with your privacy/HIPAA policies. If you want, I can list concrete questions to ask the publisher or a checklist for an operator to safely deploy this connector.

Type: OpenClaw Skill Name: uplo-healthcare Version: 1.0.0 The skill includes a high-risk tool, 'export_org_context', which allows for a 'full organizational context snapshot' (found in skill.json and SKILL.md). While the documentation describes legitimate use cases such as regulatory compliance cross-referencing, this broad permission serves as a potential vector for bulk data exfiltration. Additionally, the skill executes a remote MCP server via npx (@agentdocs1/mcp-server) and contains a future-dated timestamp in _meta.json (May 2026).