veritier

• Outcome: Review
• Latest audit: Jul 30, 2026 · 2:39 AM UTC
• Version: 3.1.1

Overview

This is a coherent remote fact-checking skill, with the main caveat that submitted text, URLs, documents, and private references are sent to Veritier's API.

Install only if you are comfortable sending the content you ask it to check to Veritier's hosted API. Avoid submitting secrets, regulated data, private internal URLs, or proprietary documents unless your policy allows it, and use test keys plus pinned dependencies for integration testing or production setups.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly requires environment variables, network access, and shell-based installation/configuration examples, but the static finding indicates those capabilities are not explicitly declared as permissions. Undeclared capabilities reduce transparency and can cause users or runners to approve a skill without understanding that secrets and user content will be sent to a remote service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README encourages sending arbitrary text, documents, and URLs to a third-party API but does not prominently warn users that their content leaves the local environment for external processing. In an agent-skill context, this omission increases the chance that sensitive prompts, private documents, or internal URLs are transmitted without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes fact-checking and verification features but does not prominently warn users that submitted text, document contents, URLs, and private grounding references are transmitted to an external API for processing. This is dangerous because users may unknowingly send sensitive or internal material off-platform, especially when the skill explicitly supports private references and document validation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README encourages users to send arbitrary text and document URLs to a remote fact-checking API but does not warn that the content will leave the local environment and be processed by a third party. In a fact-checking skill, users may submit sensitive prompts, internal documents, or confidential URLs, so the omission creates a realistic privacy and data-governance risk rather than a purely theoretical issue.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Advertising 'Verify against your own documents' without a clear warning can mislead users into uploading or referencing sensitive internal material under the assumption that it remains private. Because this skill's purpose explicitly involves document analysis, the context makes the omission more dangerous: users are being prompted to process exactly the kind of confidential content that often carries contractual, legal, or regulated restrictions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends the full input text to a third-party API for verification without any explicit user-facing privacy warning, consent step, or guidance about handling sensitive data. In a fact-checking skill, this behavior is expected functionally, but it still creates a real data-sharing risk if users paste confidential, regulated, or personal content.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code transmits AI-generated text to an external service (`https://api.veritier.ai/v1/verify`) for analysis, but the script provides no explicit notice, consent flow, or safeguards around what that text may contain. In real use, LLM outputs can include sensitive user data, internal prompts, secrets, or regulated content, so silent exfiltration to a third-party API creates a privacy and data-governance risk even if the destination is the intended vendor.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends the full private reference content (`companyPolicy`) to a third-party API as `grounding_references`, but it does not provide an explicit warning, consent prompt, or data-classification guard before transmitting potentially sensitive internal material. In an enterprise context, this can lead to unintended disclosure of proprietary policies, internal documents, or regulated data to an external service, especially because the sample encourages use with 'YOUR OWN documents' and 'internal policies' without emphasizing the sharing risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends a user-supplied URL to Veritier's third-party API for remote processing, but it does not clearly warn the operator that the provided URL will be transmitted off-host. While the code only sends the URL string rather than fetched page contents locally, the URL itself may contain sensitive information such as private document links, query tokens, or internal hostnames, so the lack of explicit disclosure is a real privacy/security issue.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool definitions encourage users to submit raw text, URLs, documents, and grounding references to the proxy, but they do not clearly disclose that all such content is forwarded to an external Veritier API. In an MCP/agent setting, users may assume processing is local or confined to the agent runtime, so sensitive documents, private references, or internal URLs could be transmitted off-system without informed consent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script transmits `company_policy` and `text_to_verify` to an external SaaS API, but the runtime messaging does not clearly warn users that their private reference content leaves the local environment. In an enterprise context, this can cause accidental disclosure of proprietary policies or internal documents by users who assume 'private references' are processed locally or remain in-house.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends a user-supplied URL to a third-party verification service and does so without an explicit privacy or data-transmission warning at the point of use. In a fact-checking skill, this is contextually expected, but it still creates a real privacy risk because users may submit internal, sensitive, or confidential URLs assuming the tool only processes them locally.

External Transmission

Medium

• Category: Data Exfiltration

Content

import httpx

response = httpx.post(
    "https://api.veritier.ai/v1/verify",
    headers={
        "Authorization": "Bearer YOUR_API_KEY",
        "Content-Type": "application/json",

• Confidence: 92% confidence
• Finding: The example explicitly posts user-provided content to https://api.veritier.ai/v1/verify, creating an external data exfiltration path by design. In a security-sensitive agent environment, this is dangerous when the skill may be invoked on confidential model context, user text, or documents without strong disclosure and approval controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

"mcpServers": {
    "veritier": {
      "type": "http",
      "url": "https://api.veritier.ai/mcp/",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }

• Confidence: 90% confidence
• Finding: The MCP configuration connects an agent directly to a remote HTTP endpoint and authorizes it with a bearer key, enabling automated transmission of agent-supplied content to an external service. This is especially sensitive because MCP integrations can make remote access feel native, obscuring the trust boundary and increasing the risk of unintended disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"text": "Your text here.", "grounding_mode": "web", "use_webhook": false}'

# Verification against private references
curl -X POST https://api.veritier.ai/v1/verify \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: This example explicitly encourages sending private document content and internal URLs as grounding references to an external service. In context, the risk is not the existence of network access itself, but the absence of a strong, explicit warning and consent boundary for transmitting potentially sensitive internal material off-platform.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
python-dotenv>=1.0
flask>=3.0

• Confidence: 96% confidence
• Finding: The dependency is specified with only a lower bound (httpx>=0.27), which makes builds non-reproducible and allows future package releases to be pulled in automatically. This increases supply-chain and stability risk because a later incompatible or compromised version could be installed without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
python-dotenv>=1.0
flask>=3.0

• Confidence: 99% confidence
• Finding: python-dotenv is both unpinned and separately flagged with a known vulnerable version in the analysis context. Using a floating lower bound increases the chance of resolving to an unsafe or unreviewed version and makes it harder to guarantee that vulnerable builds are excluded.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
python-dotenv>=1.0
flask>=3.0

• Confidence: 99% confidence
• Finding: flask>=3.0 permits any future 3.x or later release, which weakens reproducibility and can unintentionally introduce vulnerable or breaking versions. Because Flask is a web framework exposed to request-handling logic, dependency drift can directly affect the application's attack surface.

Known Vulnerable Dependency: python-dotenv==1.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: If the environment resolves to python-dotenv 1.0 as flagged, the cited advisory indicates unsafe file-handling behavior that may allow symlink following and arbitrary file overwrite in workflows that call set_key or otherwise manipulate .env files. In a skill that may process external documents and run server-side components, unsafe dotenv handling could let an attacker influence configuration or overwrite sensitive files if that functionality is present.

Known Vulnerable Dependency: flask==3.0 — 2 advisory(ies): CVE-2026-27205 (Flask session does not add `Vary: Cookie` header when accessed in some ways); CVE-2026-27205 (Flask is a web server gateway interface (WSGI) web application framework. In ver)

Medium

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: If Flask 3.0 is installed as flagged, the missing or inconsistent Vary: Cookie behavior can cause shared caches to serve content across users incorrectly, potentially exposing personalized or authenticated responses. This is more relevant here because the skill description implies a networked HTTP service, making framework-level caching and response handling issues part of the reachable attack surface.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: javascript/quickstart/test_integration.mjs:11

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: javascript/mcp/mcp_test.mjs:15

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: javascript/quickstart/extract_text.mjs:12

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: javascript/quickstart/verify_text.mjs:12