VirtualSMS — Real SIM SMS Verification

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:14 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for buying and receiving SMS verification numbers, but it handles sensitive authentication flows with broad triggers, limited user warnings, and an unpinned local npm execution path.

Review carefully before installing. Use only for accounts where third-party temporary SMS verification is allowed and acceptable, avoid banking or high-value identity accounts, keep the VirtualSMS API key scoped and rotated, prefer a pinned or sandboxed local MCP install, and require explicit user confirmation before buying numbers, retrieving OTPs, or canceling orders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned npm Package Execution Creates a Supply-Chain Code Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45-47, README.md:45-49, README.md:56-60, and skill.yaml:25-34
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

The project instructs users and MCP clients to execute virtualsms-mcp through npx without specifying an exact, reviewed package version or an integrity constraint.

Relevant code from SKILL.md:45-47:

bash

npx virtualsms-mcp

Relevant code from README.md:45-49:

bash

npx virtualsms-mcp

Relevant code from README.md:56-60:

json

{
  "mcpServers": {
    "virtualsms": {
      "command": "npx",
      "args": ["virtualsms-mcp"],
      "env": { "VIRTUALSMS_API_KEY": "vsms_your_key_here" }
    }
  }
}

Relevant code from skill.yaml:25-34:

yaml

mcp_server:
  package: virtualsms-mcp
  command: npx
  args:
    - virtualsms-mcp
  env:
    VIRTUALSMS_API_KEY: ${VIRTUALSMS_API_KEY}
  install:
    npm: virtualsms-mcp
    homepage: https://www.npmjs.com/package/virtualsms-mcp

Technical Analysis

Invoking npx virtualsms-mcp without an exact version causes package resolution to depend on mutable npm registry state. The reviewed Skill therefore does not uniquely identify the code that will execute at installation or launch time.

If the package publisher account, package distribution process, or npm package itself is compromised, a malicious release could become the version resolved by npx. Package lifecycle behavior and the MCP server entry point execute as the user running the AI client. No lockfile, package integrity hash, or exact version is supplied by this project to ensure that users receive a previously reviewed artifact.

The environment configuration also makes VIRTUALSMS_API_KEY available to the launched package. This access is functionally necessary for the legitimate MCP service, but it increases the impact of ...[truncated 1758 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version in every command and configuration, for example:

   bash

   npx --yes virtualsms-mcp@1.2.3
   

   Replace 1.2.3 with a version that has been independently reviewed.

2. Update the MCP configuration to use the same exact version:

   json

   {
     "command": "npx",
     "args": ["--yes", "virtualsms-mcp@1.2.3"]
   }
   

3. Change skill.yaml so its package and installation metadata identify an exact version rather than a floating package name.

4. Prefer a controlled installation using a committed lockfile and npm integrity metadata. Deploy from the locked dependency tree rather than resolving the latest registry version every time the MCP server starts.

5. Document the expected npm publisher, source repository, release-signing process, and package checksum so operators can verify the artifact before execution.

6. Run the MCP server in a sandbox or container with minimal filesystem access, restricted outbound network access, and no unrelated credentials in its environment.

7. Scope and rotate the VirtualSMS API key. Revoke it promptly if dependency compromise is suspected, and monitor account transactions and orders for unauthorized activity.

8. Establish a controlled update process in which new dependency versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes API-key-based SMS verification, hosted MCP use, account introspection, and phone-number purchasing, but omits clear warnings about privacy, third-party data transmission, and financial cost. Users may expose OTPs, phone numbers, service metadata, account usage details, and API keys to an external provider without realizing the sensitivity or billing implications, which is especially risky for agents handling authentication flows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run npx virtualsms-mcp without pinning a version or integrity source, which causes execution of whatever package version is current at install time. In an agent-skill context, this creates a supply-chain risk: a compromised publisher account, malicious update, or typosquat could lead users or agents to execute attacker-controlled code locally with the privileges of the client environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is very broad and includes highly generic terms like OTP, phone number, account verification, and two-factor authentication, which can cause the skill to activate in unrelated contexts. Because this skill can procure third-party SMS numbers and facilitate account verification flows, unintended invocation increases the chance of privacy-impacting actions or assistance with risky account creation and bypass workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx virtualsms-mcp without a pinned version allows whatever package version is current at execution time to be fetched and run, creating a supply-chain risk. If the package is compromised, typo-squatted, or a malicious update is published, the host may execute attacker-controlled code with the agent's local permissions and access to secrets such as API keys.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill promotes using a third-party provider to receive verification codes for many services but does not warn users that this exposes phone metadata, verification events, and possibly account-linked activity to an external service. In context, this is more dangerous because the listed use cases include consumer platforms and financial or identity-sensitive services, where use of rented numbers may violate terms, weaken account recovery assurances, or create privacy and fraud risks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill launches an MCP server via npx virtualsms-mcp without pinning an exact package version, which means future installs may pull whatever version is current at execution time. If the npm package is compromised, typosquatted, or a malicious update is published, an agent invoking this skill could execute attacker-controlled code with access to the provided VIRTUALSMS_API_KEY and the local agent environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad phrases like 'phone number', 'OTP code', and 'account verification', which are common in benign conversations and may cause the skill to be auto-invoked unexpectedly. In this skill's context, unintended invocation is more sensitive because the tool can procure real SIM-backed numbers and interact with SMS verification flows, potentially exposing secrets or enabling actions the user did not intend.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.