Vocab Voyage Mcp V1.1.1

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:03 AM UTC
• Version: 1.1.1

Overview

Vocab Voyage appears to be a legitimate remote vocabulary tutor, but it needs review because it stores account-linked study activity and referral telemetry, and one documented install path can run an unpinned third-party package.

Install only if you are comfortable using a hosted vocabulary service that may store study progress, answers, XP, mastery state, and referral-linked usage records. Prefer the OpenClaw remote install path, avoid the unpinned `npx -y mcp-remote` setup unless you pin and trust the package, and do not provide a personal token unless you want personalized progress features.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:22

Finding

Unpinned Third-Party Package Is Automatically Downloaded and Executed

Content

View full analysis

Remediation

View remediation

", "https://gponcrussdahcdyrlhcr.supabase.co/functions/v1/mcp-server" ] } ``` 2. Where supported, install dependencies through a lockfile that records resolved versions and integrity hashes. 3. Verify the package publisher, provenance attestations, and registry signatures before recommending the package. 4. Document a controlled update process so the pinned version is changed only after security review. 5. Prefer a host's native remote MCP transport when available, eliminating the need to execute a locally downloaded proxy package. 6. Run the MCP proxy with a restricted environment and only the credentials required for this service. ]]>

other

Note

• Location: SUBMISSION_LINKS.md:17

Finding

Per-Call Referral Telemetry Correlates Usage with User or IP-Derived Identifiers

Content

View full analysis

` query param. The MCP server records this on every tool call into `mcp_tool_calls.install_source`, so you can see which channel actually drives usage. The server normalizes refs to lowercase `[a-z0-9_-]{1,32}`. The slugs below are the canonical ones — match these exactly so the Friday analytics query buckets cleanly. ``` ```sql select coalesce(install_source, '(direct/no-ref)') as source, count(*) as calls, count(distinct user_id) as authed_users, count(distinct ip_hash) filter (where user_id is null) as anon_clients, round(avg(latency_ms))::int as avg_latency_ms, round(100.0 * count(*) filter (where status = 'ok') / count(*), 1) as success_pct from public.mcp_tool_calls where created_at >= now() - interval '7 days' group by 1 order by calls desc; ``` ### Technical Analysis The hosted MCP service records the referral channel on every tool invocation. The documented analytics query correlates usage with authenticated `user_id` values or distinct `ip_hash` values for anonymous clients. Operational request logging can be legitimate, and the referral value is documented in `SUBMISSION_LINKS.md`. However, per-call acquisition tracking and identity-linked aggregation are not necessary to provide vocabulary definitions, flashcards, quizzes, or study plans. The primary user-facing `SKILL.md` and OpenClaw quickstart describe progress persistence but do not prominently explain this per-call referral telemetry, identifier usage, retention period, or opt-out mechanism. Hashing IP addresses reduces direct exposure but does not make the data anonymous when hashes remain stable enough to count d ...[truncated 1471 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (30)

Tainted flow: 'req' from os.environ.get (line 24, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/python-progress.py (reported line 34)May include surrounding context.

python

},
)

with urllib.request.urlopen(req) as resp:
    print(json.dumps(json.loads(resp.read()), indent=2))

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

md

## Tool catalog (auto-generated)

<!-- mcp:tools:start -->
Tool count: 20.

- `get_word_of_the_day` — Returns today's vocabulary Word of the Day, optionally scoped to a test family.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

## Tool catalog (auto-generated)

<!-- mcp:tools:start -->
Tool count: 20.

- `get_word_of_the_day` — Returns today's vocabulary Word of the Day, optionally scoped to a test family.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/openclaw-quickstart.md (reported line 57)May include surrounding context.

md

## Tool catalog (auto-generated)

<!-- mcp:tools:start -->
Tool count: 20.

- `get_word_of_the_day` — Returns today's vocabulary Word of the Day, optionally scoped to a test family.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

md

- `get_recommended_next_action` — Returns a one-line recommendation for what the user should do next.
- `list_starter_prompts` — Lists the 6 MCP prompts (vocab_kickoff, test_prep_quiz, session_debrief, …) for hosts that don't surface prompts/list.
- `record_word_result` — Auth: log a per-card answer (correct or incorrect).
- `record_session_complete` — Auth: log session totals and award XP.
- `award_game_xp` — Auth: grant bonus XP from a completed mini-game round.
- `mark_word_known` — Auth: add a word to the user's queue or mastered list.
- `mark_word_difficult` — Auth: flag a word as needing more review.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- `get_recommended_next_action` — Returns a one-line recommendation for what the user should do next.
- `list_starter_prompts` — Lists the 6 MCP prompts (vocab_kickoff, test_prep_quiz, session_debrief, …) for hosts that don't surface prompts/list.
- `record_word_result` — Auth: log a per-card answer (correct or incorrect).
- `record_session_complete` — Auth: log session totals and award XP.
- `award_game_xp` — Auth: grant bonus XP from a completed mini-game round.
- `mark_word_known` — Auth: add a word to the user's queue or mastered list.
- `mark_word_difficult` — Auth: flag a word as needing more review.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · docs/openclaw-quickstart.md (reported line 75)May include surrounding context.

md

- `get_recommended_next_action` — Returns a one-line recommendation for what the user should do next.
- `list_starter_prompts` — Lists the 6 MCP prompts (vocab_kickoff, test_prep_quiz, session_debrief, …) for hosts that don't surface prompts/list.
- `record_word_result` — Auth: log a per-card answer (correct or incorrect).
- `record_session_complete` — Auth: log session totals and award XP.
- `award_game_xp` — Auth: grant bonus XP from a completed mini-game round.
- `mark_word_known` — Auth: add a word to the user's queue or mastered list.
- `mark_word_difficult` — Auth: flag a word as needing more review.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · server-card.json (reported line 115)May include surrounding context.

json

- `get_recommended_next_action` — Returns a one-line recommendation for what the user should do next.
- `list_starter_prompts` — Lists the 6 MCP prompts (vocab_kickoff, test_prep_quiz, session_debrief, …) for hosts that don't surface prompts/list.
- `record_word_result` — Auth: log a per-card answer (correct or incorrect).
- `record_session_complete` — Auth: log session totals and award XP.
- `award_game_xp` — Auth: grant bonus XP from a completed mini-game round.
- `mark_word_known` — Auth: add a word to the user's queue or mastered list.
- `mark_word_difficult` — Auth: flag a word as needing more review.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · smithery.yaml (reported line 98)May include surrounding context.

yaml

- `get_recommended_next_action` — Returns a one-line recommendation for what the user should do next.
- `list_starter_prompts` — Lists the 6 MCP prompts (vocab_kickoff, test_prep_quiz, session_debrief, …) for hosts that don't surface prompts/list.
- `record_word_result` — Auth: log a per-card answer (correct or incorrect).
- `record_session_complete` — Auth: log session totals and award XP.
- `award_game_xp` — Auth: grant bonus XP from a completed mini-game round.
- `mark_word_known` — Auth: add a word to the user's queue or mastered list.
- `mark_word_difficult` — Auth: flag a word as needing more review.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

md

## Widget catalog (auto-generated)

<!-- mcp:widgets:start -->
Widget count: 17.

- `ui://vocab-voyage/word-of-the-day` — Word of the Day (learn, 560x360) via `get_word_of_the_day`

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

## Widget catalog (auto-generated)

<!-- mcp:widgets:start -->
Widget count: 17.

- `ui://vocab-voyage/word-of-the-day` — Word of the Day (learn, 560x360) via `get_word_of_the_day`

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/openclaw-quickstart.md (reported line 90)May include surrounding context.

md

## Widget catalog (auto-generated)

<!-- mcp:widgets:start -->
Widget count: 17.

- `ui://vocab-voyage/word-of-the-day` — Word of the Day (learn, 560x360) via `get_word_of_the_day`

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 93)May include surrounding context.

md

- `ui://vocab-voyage/game/crossword` — Game · Crossword (play, 640x720) via `play_game`
- `ui://vocab-voyage/game/word_search` — Game · Word Search (play, 640x720) via `play_game`
- `ui://vocab-voyage/session-debrief` — Session Debrief (coach, 600x640) via `get_sparkle_guidance`
<!-- mcp:widgets:end -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

- `ui://vocab-voyage/game/crossword` — Game · Crossword (play, 640x720) via `play_game`
- `ui://vocab-voyage/game/word_search` — Game · Word Search (play, 640x720) via `play_game`
- `ui://vocab-voyage/session-debrief` — Session Debrief (coach, 600x640) via `get_sparkle_guidance`
<!-- mcp:widgets:end -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/openclaw-quickstart.md (reported line 110)May include surrounding context.

md

- `ui://vocab-voyage/game/crossword` — Game · Crossword (play, 640x720) via `play_game`
- `ui://vocab-voyage/game/word_search` — Game · Word Search (play, 640x720) via `play_game`
- `ui://vocab-voyage/session-debrief` — Session Debrief (coach, 600x640) via `get_sparkle_guidance`
<!-- mcp:widgets:end -->

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states that taps inside widgets persist activity to the user's account, but it does so as product behavior rather than as a clear privacy warning or consent notice. This can cause users to trigger account writes without understanding that learning activity, answers, and session completion data will be stored, creating a transparency and privacy-risk issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tool catalog lists several auth-only tools that log answers, session totals, XP, mastery state, and adaptive level changes, but it does not include a clear warning about collection and storage of account-linked educational activity. Users may reasonably treat these as harmless study tools while unknowingly causing durable profile updates and behavioral tracking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document explicitly instructs submitters to append per-channel referral identifiers and states that every tool call records this attribution into a server-side table. This creates user/activity tracking behavior without any nearby disclosure, consent guidance, retention limits, or privacy notice, which is a real privacy/security concern because downstream users and integrators may unknowingly enable telemetry tied to install source and potentially correlated activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest advertises authenticated scopes like profile.read and progress.read plus tools such as get_my_progress and record_session_complete, but it does not provide any user-facing disclosure about what learner data is collected, when it is transmitted, or how it is used. This creates a privacy and consent gap: an integrating agent or end user may unknowingly expose educational progress or profile information to the service, which is especially sensitive in a tutoring context involving minors or students.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest shows the skill uses a remote MCP server over streamable HTTP and offers authenticated personalized features, but it does not clearly warn users that their prompts, interactions, and progress data may be sent to an external hosted service. This creates a transparency and privacy issue because users may assume local-only behavior while educational usage data is transmitted off-platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest explicitly describes personal progress dashboards and persistence of quiz, flashcard, and game results, but it does not present a clear privacy warning or data-retention notice to users at install time. Because this skill is aimed at education and may be used by students, silent collection and storage of learning activity increases privacy risk and can expose behavioral or profile data beyond user expectations.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/openclaw-quickstart.md (reported line 23)May include surrounding context.

Option 2 — Manual skill folder

Create the file ~/.openclaw/skills/vocab-voyage/SKILL.md with the following contents:

markdown

---

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/openclaw-quickstart.md (reported line 150)May include surrounding context.

Option 2 — Manual skill folder

Create the file ~/.openclaw/skills/vocab-voyage/SKILL.md with the following contents:

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/openclaw-quickstart.md (reported line 23)May include surrounding context.

Option 2 — Manual skill folder

Create the file ~/.openclaw/skills/vocab-voyage/SKILL.md with the following contents:

markdown

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/curl-quiz.sh (reported line 17)May include surrounding context.

sh

AUTH_HEADER=(-H "Authorization: Bearer ${VV_MCP_TOKEN}")
fi

curl -sS -X POST "$ENDPOINT" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  "${AUTH_HEADER[@]}" \