Content Moderation

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a coherent Vettly moderation integration, but users should notice it runs an external MCP package with a Vettly API key and sends moderation content to Vettly.

Before installing, confirm you trust the @vettly/mcp package, consider pinning its version, and use a scoped Vettly API key if possible. Treat any text, image URL, video URL, policy, or recent decision you process with this skill as data that may be handled by Vettly.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill depends on code fetched through npx for the Vettly MCP server.

Why it was flagged

The setup runs an external npm-hosted MCP server and does not pin a package version. This is disclosed and purpose-aligned, but users must trust the package source and current published version.

Skill content
"command": "npx", "args": ["-y", "@vettly/mcp"]
Recommendation

Verify the @vettly/mcp package and publisher before use, and consider pinning a known-good version in your MCP configuration.

What this means

Anyone or any agent workflow using this configured MCP server may be able to perform Vettly moderation requests and read related account information allowed by the key.

Why it was flagged

The MCP server receives a Vettly API key. That credential is expected for the stated service integration, but it grants account-level access for the exposed moderation and account tools.

Skill content
"env": { "VETTLY_API_KEY": "your-api-key" }
Recommendation

Use a scoped or least-privileged Vettly API key if available, store it securely, and rotate it if it is exposed.

What this means

Text, image URLs, video URLs, and moderation decision data may be shared with or retrieved from Vettly during normal use.

Why it was flagged

Moderation content or media URLs are sent through the Vettly MCP/API path, and the skill can also retrieve recent moderation decisions. This is disclosed and aligned with the moderation purpose.

Skill content
`content` (required) - The content to moderate (text string, or URL for images/video)
Recommendation

Only moderate content you intend to send to Vettly, and review Vettly's data handling policy before using it for private or regulated content.