Vocab Voyage Mcp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a legitimate vocabulary MCP service, but its setup and tracking details need review before installation.

Review the privacy and installation implications before using it. Prefer the direct hosted MCP connector or OpenClaw install path over the unpinned npx bridge, avoid putting bearer tokens in command-line arguments when possible, and treat the service as recording usage/source metadata on tool calls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:66
• Finding: Unpinned Third-Party Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 66–86 **Vulnerability Type**: Unpinned dependency execution through `npx -y` **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "vocab-voyage": { "command": "npx", "args": ["-y", "mcp-remote", "https://gponcrussdahcdyrlhcr.supabase.co/functions/v1/mcp-server"] } } } ``` The authenticated configuration uses the same unpinned package and additionally exposes a bearer token to the executed process: ```json { "mcpServers": { "vocab-voyage": { "command": "npx", "args": [ "-y", "mcp-remote", "https://gponcrussdahcdyrlhcr.supabase.co/functions/v1/mcp-server", "--header", "Authorization: Bearer vv_mcp_REPLACE_ME" ] } } } ``` ### Technical Analysis The documented Claude Desktop configuration invokes `npx -y mcp-remote` without an exact package version or integrity constraint. When the package is not already available in the local cache, `npx` can retrieve the current package release from the configured package registry and execute it automatically. The `-y` option suppresses the normal installation confirmation. Consequently, the code executed by this configuration is not immutable and may differ from the code that existed when the Skill was audited. A compromised package registry account, malicious future release, dependency compromise, or registry-resolution attack could introduce arbitrary code into the execution path. In the authenticated example, the downloaded process also receives the personal MCP bearer token as a command-line argument. A malicious package could read and exfiltrate that token in addition to accessing resources available to the desktop user's process. ### Attack Path 1. An attacker compromises the `mcp-remote` package, one of its dependencies, or its package-publishing account. 2. The attacker publishes a malicious release under the package name resolved by `npx`. 3. A ...[truncated 1240 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `mcp-remote` to an exact, reviewed version rather than resolving the latest release: ```json { "command": "npx", "args": [ "-y", "mcp-remote@REVIEWED_EXACT_VERSION", "https://gponcrussdahcdyrlhcr.supabase.co/functions/v1/mcp-server" ] } ``` 2. Prefer a separately installed and verified bridge binary over automatic package download at application startup. 3. Publish expected package checksums, signatures, and provenance information where supported. 4. Use a lockfile and integrity metadata for any locally maintained installation procedure. 5. Remove `-y` from instructions where automatic unattended acquisition is unnecessary. 6. Document how users can verify the package publisher, version, signature, and integrity before execution. 7. Avoid passing bearer tokens directly in command-line arguments where they may be exposed through process listings or logs. Use a protected environment variable, secret store, or client-supported credential mechanism. 8. Grant tokens only the minimum necessary scopes and provide clear rotation and revocation procedures for suspected compromise. ]]>

other

Note

• Location: SUBMISSION_LINKS.md:1
• Finding: Per-Call Usage and Client Attribution Telemetry Is Not Disclosed in the Primary Skill Description<![CDATA[ ## Vulnerability Details **File Location**: `SUBMISSION_LINKS.md`, lines 1–4 and 60–68 **Vulnerability Type**: Undisclosed usage tracking and client correlation **Risk Level**: Low ### Vulnerable Code ```markdown # Submission links — use these exact URLs (with `?ref=` for attribution) When listing the Vocab Voyage MCP endpoint in any directory or community post, use the variant that includes the `?ref=<channel>` query param. The MCP server records this on every tool call into `mcp_tool_calls.install_source`, so you can see which channel actually drives usage. The server normalizes refs to lowercase `[a-z0-9_-]{1,32}`. The slugs below are the canonical ones — match these exactly so the Friday analytics query buckets cleanly. ``` The documented analytics query shows additional per-call data used for aggregation: ```sql select coalesce(install_source, '(direct/no-ref)') as source, count(*) as calls, count(distinct user_id) as authed_users, count(distinct ip_hash) filter (where user_id is null) as anon_clients, round(avg(latency_ms))::int as avg_latency_ms, round(100.0 * count(*) filter (where status = 'ok') / count(*), 1) as success_pct from public.mcp_tool_calls where created_at >= now() - interval '7 days' group by 1 order by calls desc; ``` ### Technical Analysis The repository states that the hosted server records the installation source on every tool invocation. The analytics query further demonstrates that stored tool-call records include or support association with: - An authenticated `user_id`. - A hashed IP identifier for anonymous clients. - Installation or referral source. - Request latency. - Request status. - A creation timestamp used for time-window analysis. Hashing an IP address does not necessarily make the resulting identifier anonymous. A stable hash can still permit repeated calls from the same client to be correlated, and IP addresses have a relatively constrained input space when no secret-keyed construction i ...[truncated 1870 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a clear telemetry disclosure to `SKILL.md`, `README.md`, and the user-facing connection flow before the first tool call. 2. Describe every collected field, its purpose, retention period, legal basis where applicable, and whether it is shared with third parties. 3. Explain precisely how IP identifiers are transformed. Prefer a keyed HMAC with a protected, periodically rotated key over an unsalted deterministic hash. 4. Minimize collection by removing fields not required for security, reliability, or explicitly disclosed analytics. 5. Apply short retention periods and automatically delete or aggregate raw per-call records. 6. Enforce least-privilege database access, audit administrative access, and encrypt telemetry in transit and at rest. 7. Provide an opt-out or non-attributed endpoint where operationally feasible. 8. Publish deletion and data-access procedures for authenticated users. 9. Avoid treating hashed IP addresses as fully anonymous identifiers in privacy documentation or security design. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly instructs third parties to include attribution identifiers via `?ref=` or `x-install-source`, and states these are recorded on every tool call for analytics. This creates undisclosed telemetry linkage at the point of installation/use, which can undermine user privacy expectations and enable tracking of acquisition source without clear end-user notice or consent.

Static analysis

No suspicious patterns detected.