CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · README.md

MEDIUM — it fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.

Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted

excerptREADME.md· markdown

165

166## Security Notes

167

168- Never share your access token

169- The `offline` scope provides a non-expiring token

170- Review permissions before authorizing

Occurrences

1 occurrence · at L167

How to fix

Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.

Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IMPERATIVE-01sha25682ccbf2b208f5d32…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md5.0 KB · Markdown

VK MCP Server

Model Context Protocol (MCP) server for VK (VKontakte) social network API

Enables AI assistants like Claude to interact with VK through a standardized interface.

Features

Read Operations: Get users, wall posts, groups, friends, newsfeed, photos
Write Operations: Create posts, add comments
Analytics: Get community statistics
Secure: Token-based authentication via environment variable
Tested: Comprehensive test coverage
Easy Install: Available on npm and MCP Registry

Quick Start

Installation

npm install -g vk-mcp-server

Or run directly with npx:

npx vk-mcp-server

MCP Registry

Also available in the official MCP Registry:

io.github.bulatko/vk

Getting VK Access Token

Go to VK Developers and create a Standalone app
Get your app ID
Open this URL (replace YOUR_APP_ID):

   https://oauth.vk.com/authorize?client_id=YOUR_APP_ID&display=page&redirect_uri=https://oauth.vk.com/blank.html&scope=friends,wall,groups,photos,stats,offline&response_type=token&v=5.199

Authorize and copy the access_token from the URL

Configuration

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "vk": {
      "command": "npx",
      "args": ["-y", "vk-mcp-server"],
      "env": {
        "VK_ACCESS_TOKEN": "your_access_token_here"
      }
    }
  }
}

Claude Code

Add to your project's .mcp.json:

{
  "mcpServers": {
    "vk": {
      "command": "npx",
      "args": ["-y", "vk-mcp-server"],
      "env": {
        "VK_ACCESS_TOKEN": "your_access_token_here"
      }
    }
  }
}

Available Tools

Tool	Description
`vk_users_get`	Get user profiles by IDs or screen names
`vk_wall_get`	Get posts from user/community wall
`vk_wall_post`	Publish a new post
`vk_wall_create_comment`	Add comment to a post
`vk_groups_get`	Get user's communities list
`vk_groups_get_by_id`	Get community info by ID
`vk_friends_get`	Get user's friends list
`vk_newsfeed_get`	Get user's newsfeed
`vk_stats_get`	Get community statistics (admin only)
`vk_photos_get`	Get photos from albums

Usage Examples

Once configured, you can ask Claude:

"Get information about Pavel Durov's VK profile"
"Show me the latest 5 posts from the VK official community"
"Post 'Hello World!' on my wall"
"Get the list of communities I'm a member of"
"Show my newsfeed"

Example Conversation

User: What's on Pavel Durov's wall?

Claude: I'll check Pavel Durov's VK wall for recent posts.
[Uses vk_wall_get with domain="durov"]

Here are the latest posts from Pavel Durov's wall:
1. [Post content...]
2. [Post content...]

Testing

Run the test suite:

npm test

Run tests with coverage:

npm run test:coverage

API Reference

This server wraps VK API v5.199. For detailed parameter documentation, see:

Security Notes

Never share your access token
The offline scope provides a non-expiring token
Review permissions before authorizing
For production, consider using a service token

Contributing

Contributions are welcome! Please read the Contributing Guidelines first.

Fork the repository
Create your feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add some amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request

License

Links

Made with ❤️ for the MCP ecosystem

Vk Mcp Server— agent skill

Is Vk Mcp Server safe to install?

VK MCP Server

Features

Quick Start

Installation

MCP Registry

Getting VK Access Token

Configuration

Claude Desktop

Claude Code

Available Tools

Usage Examples

Example Conversation

Testing

API Reference

Security Notes

Contributing

License

Links

Audit the pieces. Scan the whole. Decide.