Vocab Voyage Mcp V1.1.1

Security checks across malware telemetry and agentic risk

Overview

This is a coherent hosted vocabulary-practice skill, but personalized features use an optional account token and store study progress.

This skill appears purpose-aligned for vocabulary practice. Before enabling personalized features, understand that your token lets the hosted Vocab Voyage service read and update your study progress; use anonymous mode for public definitions/quizzes if you do not want account-linked tracking.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI03: Identity and Privilege Abuse
Medium
What this means

If you provide a token, the remote service can access your Vocab Voyage profile/progress data within the listed scopes.

Why it was flagged

The skill can use a personal bearer token with profile and progress scopes for personalized features.

Skill content
"Optional personal MCP token (vv_mcp_…)" ... "scopes": ["mcp.read", "mcp.tools", "profile.read", "progress.read"]
Recommendation

Use a token only if you want personalized progress features, generate it from the documented Vocab Voyage page, and revoke/rotate it when no longer needed.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

Normal study interactions may update your learning history, XP, mastered words, or review queue.

Why it was flagged

Interactive widget actions can call tools that mutate the user's study-progress state.

Skill content
Taps inside widgets persist to the user's account via `record_word_result`, `record_session_complete`, `mark_word_known`, and `award_game_xp`.
Recommendation

Install only if you are comfortable with study interactions being saved; avoid authenticated mode if you only want anonymous practice.

#
ASI06: Memory and Context Poisoning
Low
What this means

Your answers, missed words, streaks, and progress may be stored and reused by the service for future study sessions.

Why it was flagged

The skill uses persistent personal learning data to show progress and drive recommendations.

Skill content
`get_my_progress` (widget-aware) — Auth-only personal dashboard: streak, XP, mastery split, next-up words, recent misses.
Recommendation

Review Vocab Voyage's account and privacy settings, and use anonymous mode if you do not want persistent personalized progress.