首页龙虾技能列表 › Uplo Defense

Uplo Defense

v1.0.0

AI-powered defense knowledge management. Search mission documentation, logistics records, personnel data, and ITAR-controlled information with structured ext...

0· 145·0 当前·0 累计
by @roojenkins (RooJenkins)·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/14
安全扫描
VirusTotal
无害
查看报告
OpenClaw
可疑
medium confidence
The skill's behavior generally matches a defense knowledge connector, but metadata inconsistencies and an implicit npm-based MCP install plus required API credentials warrant caution before installing or trusting with ITAR/controlled data.
评估建议
This skill appears to be a connector to a UPLO instance and its runtime will send queries and logs to whatever agentdocs_url you configure using the provided API key. Before installing: (1) reconcile the manifest inconsistency — confirm the skill actually requires agentdocs_url and api_key and that the registry view is out-of-date; (2) verify the authenticity and provenance of the npm package @agentdocs1/mcp-server (review the package source, maintainers, and recent versions) or prefer a vetted ...
详细分析 ▾
用途与能力
The skill claims to provide structured, access-controlled searches over defense documentation and the SKILL.md instructs exactly those operations (search_with_context, search_knowledge, get_directives, export_org_context, etc.). However the registry metadata shown earlier lists no required env/config, while the included skill.json requires an agentdocs_url and api_key. That inconsistency between declared registry requirements and the embedded skill manifest is concerning and should be reconciled.
指令范围
SKILL.md stays within the stated purpose: it directs the agent to load identity context, query directives and knowledge, export org context, and log sessions. Those instructions are appropriate for an access-controlled knowledge connector. The explicit requirement to call log_conversation (audit logging) and to verify identity is consistent with handling sensitive data, but also means queries and results will be transmitted to whatever endpoint you configure — ensure that endpoint is trusted and properly secured.
安装机制
Although the registry indicated 'instruction-only', the included skill.json defines an MCP server command that uses `npx -y @agentdocs1/mcp-server` (npm package). That implies the agent will download and run an npm package at runtime (moderate risk). The package name is not a well-known system package in this report; downloading/executing code via npx introduces additional supply-chain and trust concerns. The README also shows example configuration that will point the runtime to a user-supplied URL.
凭证需求
The skill.json requires agentdocs_url and api_key (MCP token), which are expected for a connector to an external UPLO instance and are proportionate to the stated function. However the registry summary above claimed no required envs — an internal inconsistency. Because the API key grants access to potentially highly sensitive defense data, confirm least-privilege scope for the token, verify the target URL is an internal/trusted instance, and ensure the token is not reused elsewhere.
持久化与权限
always:false and no special OS restrictions are present. The skill does not request permanent platform-wide privileges in the manifest. The only persistence element is that the MCP server (npm tool) may be launched to provide the tool endpoints; that behavior is normal for connectors but should be run only against trusted packages and endpoints.
安全有层次,运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发,无需署名。

运行时依赖

无特殊依赖

版本

latestv1.0.02026/3/18

uplo-defense 1.0.0 — Initial Release - Launches AI-powered defense knowledge management with structured, access-controlled search. - Supports search across mission documentation, logistics records, personnel data, and ITAR-controlled information. - Provides core tools: contextual and direct search, directives review, organizational export, audit logging, and outdated document flagging. - Designed to respect clearance levels, program access, and export control constraints. - Includes user guidance for identity verification, compliance logging, and workflow examples for common defense scenarios.

● 无害

安装命令 点击复制

官方npx clawhub@latest install uplo-defense
镜像加速npx clawhub@latest install uplo-defense --registry https://cn.clawhub-mirror.com

技能文档

Defense organizations operate under constraints that commercial enterprises never face: ITAR/EAR export controls, security classification levels, compartmented access, and regulatory oversight from DCSA, DCMA, and contracting officers who audit everything. UPLO Defense provides structured, access-controlled search across program documentation, logistics records, technical data packages, and personnel qualifications while respecting the classification boundaries that make defense knowledge management uniquely difficult.

Session Start

Identity verification is non-negotiable in defense. Your clearance level, program access list, and need-to-know determinations control what you see. Load your identity immediately:

get_identity_context

Directives in defense include OPORD fragments, program milestones, acquisition decision points, and ITAR compliance mandates. Review them before proceeding:

get_directives

Important: If your identity context does not reflect your expected clearance level or program access, stop and contact your security officer. Do not attempt workarounds.

When to Use

  • A program manager needs to locate the CDR (Critical Design Review) action items from six months ago to verify closure status before the upcoming TRR
  • Searching for ITAR-controlled technical data packages related to a subsystem that is being proposed for foreign military sale
  • Verifying whether a specific subcontractor has the required facility clearance level documented before sharing controlled technical data
  • Assembling the Contractor Performance Assessment Report (CPAR) narrative by pulling delivery milestones, quality metrics, and cost performance index data
  • A logistics officer needs to find the provisioning technical documentation for a replacement part across multiple national stock numbers
  • Checking the current CONOPS (Concept of Operations) version for a program and determining what has changed since the last milestone review
  • Reviewing whether a cybersecurity Plan of Action and Milestones (POA&M) finding has been remediated before the next DCMA audit

Example Workflows

Technical Data Package Review for FMS Case

A foreign military sales case requires release of technical data for a radar subsystem. The export control officer needs to determine what data exists and its ITAR classification.

search_with_context query="radar subsystem AN/APG technical data package ITAR classification export control"

Verify the distribution statement on the relevant documents:

search_knowledge query="distribution statement D controlled technical data radar subsystem drawings"

Check if there are existing Technology Assessment/Control Plans (TA/CP) for this subsystem:

search_knowledge query="technology assessment control plan radar subsystem foreign disclosure"
log_conversation summary="Reviewed radar subsystem TDP for FMS release eligibility; identified Distribution D documents requiring TAA before disclosure" topics='["ITAR","FMS","export-control","radar"]' tools_used='["search_with_context","search_knowledge"]'

Milestone Decision Preparation

A program is approaching Milestone B (Engineering & Manufacturing Development). The PM needs to assemble the required documentation.

search_with_context query="program milestone B EMD required documentation acquisition decision memorandum"

Pull cost and schedule performance data:

search_knowledge query="earned value management BCWP CPI SPI program cost performance report"

Review the current risk register:

search_knowledge query="program risk register critical risks mitigation status likelihood consequence"

Get the organizational context showing program office structure:

export_org_context

Key Tools for Defense

search_with_context — Defense programs generate deeply interconnected documentation. A single requirement traces from CONOPS through system specifications, test procedures, and logistics support plans. Graph traversal follows these threads. Example: search_with_context query="KPP threshold objective values system specification traceability"

search_knowledge — Direct retrieval when you know the document type or identifier: a specific CDRL number, a DI-number, an NSN, or a MIL-STD reference. Example: search_knowledge query="CDRL A003 software development plan current version"

get_directives — In defense, directives carry the weight of orders. Program direction memoranda, acquisition decision memoranda, and ITAR compliance mandates are not suggestions. Always check.

export_org_context — Produces the program office structure, IPT (Integrated Product Team) leads, key subcontractors, and systems of record. Required for milestone reviews and audit responses.

log_conversation — Defense audit requirements demand traceability. Every query session involving controlled data should be logged. This is not optional — it is a compliance requirement.

flag_outdated — Technical manuals, logistics documentation, and specification references become obsolete through Engineering Change Proposals (ECPs). Flagging outdated documents prevents the dangerous scenario of manufacturing or maintaining equipment against a superseded configuration.

Tips

  • Use standard defense identifiers in searches: CDRL numbers, DI-numbers (e.g., DI-MGMT-81466), national stock numbers (NSNs), CAGE codes, and MIL-STD references. The extraction engine treats these as structured fields.
  • Classification tier mapping: public = approved for public release, internal = FOUO/CUI, confidential = Confidential, restricted = Secret and above. If expected results do not appear, the issue is almost certainly a clearance mismatch, not missing data.
  • ITAR-controlled technical data queries should always be logged. The log creates an audit trail that demonstrates compliant handling of controlled items.
  • When assembling milestone review packages, start with export_org_context to establish the program baseline, then use targeted search_knowledge calls for each required document rather than broad searches that may surface documents outside your need-to-know.
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制

了解定制服务