reopen 48152 thanks there seems to be a general issue with "installer packages" like flashplugin-nonfree and msttcorefonts, such packages don't contain any non-free software in the package itself (and hence are placed in contrib) but installing them causes non-free software to be installed on to the system from a source other than debian.
imho vrms should probablly flag up contrib packages as well, they represent a dependency of some form on non-free software even though they don't actually contain it. better still would be for vrms to add detection methods other than searching the debian package database (since that is after all not the only way to install stuff on a debian system, especially stuff like mozilla plugins)
