Content Moderation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:22 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Vettly content-moderation integration, but users should be aware it sends moderated content to an external service and runs an unpinned npm MCP package.

Before installing, confirm you trust the `@vettly/mcp` package and prefer pinning a reviewed version. Use a dedicated, revocable Vettly API key, avoid passing secrets or regulated content unless approved for Vettly processing, and treat recent decision outputs as potentially sensitive moderation data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–20
Vulnerability Type: Unpinned dependency execution
Risk Level: Medium

Vulnerable Code

json

"command": "npx",
"args": ["-y", "@vettly/mcp"],

Technical Analysis

The skill directs npx to resolve and execute @vettly/mcp without specifying an exact package version. The -y option suppresses the installation confirmation, allowing the package selected by the registry at execution time to be downloaded and run automatically.

Consequently, the code that runs can differ from the version originally reviewed. If the package publisher account, package release process, registry resolution path, or a future release is compromised, attacker-controlled code could execute with the permissions and environment of the MCP process. The process is also configured to receive VETTLY_API_KEY, making that credential accessible to the downloaded package.

Attack Path

1. An attacker compromises the @vettly/mcp publishing account, release pipeline, or another relevant supply-chain component.
2. The attacker publishes a malicious version under the expected package name.
3. The documented configuration invokes npx -y @vettly/mcp without an exact version.
4. npx resolves, downloads, and executes the malicious release without prompting the user.
5. The package reads VETTLY_API_KEY from its environment and may perform arbitrary actions permitted to the MCP process, including local data access and outbound network requests.

Impact Assessment

Successful exploitation could expose the configured Vettly API credential and any data available to the MCP process. Because npm packages can execute native Node.js operations, malicious package code could read or alter files accessible to the current user, access inherited environment variables, transmit information externally, or execute child processes.

The exact scope is bounded by the operating-system privileges, filesystem access, ...[truncated 167 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, for example:

   json

   "command": "npx",
   "args": ["-y", "@vettly/mcp@X.Y.Z"],
   

2. Prefer installing the package through a committed lockfile and invoking the verified local executable rather than resolving it dynamically on every run.

3. Verify package provenance, publisher identity, release signatures or attestations, and integrity hashes before deployment.

4. Establish an explicit dependency-update process that includes security review and testing before changing the pinned version.

5. Run the MCP server in a sandbox or restricted service account with only the required filesystem and network access.

6. Provide only VETTLY_API_KEY to the process, avoid inheriting unrelated secrets, and use a narrowly scoped, revocable API key.

7. Monitor package updates and rotate the API key immediately if supply-chain compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to send text and media URLs to Vettly's external moderation service but does not disclose that user content leaves the local environment and is processed by a third party. This can cause accidental transmission of sensitive, regulated, or confidential content without informed consent or appropriate data-handling review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill encourages reviewing recent moderation decisions and flagged content without warning that these results may contain sensitive user-generated content, moderation metadata, and account-level operational data. In practice, this can expose reviewers or downstream systems to private or harmful content and increase the risk of inappropriate access or disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.