Varg Ai

• Outcome: Review
• Latest audit: Jul 11, 2026 · 5:30 AM UTC
• Version: 2.0.8

Overview

This media-generation skill is mostly coherent, but it asks the agent to handle API credentials, account sign-in, credit purchases, remote uploads, and self-updating in ways users should review first.

Install only if you are comfortable letting the agent use varg cloud services, paid API credits, and local project files for rendering. Before use, avoid printing API keys, do not commit `.env`, prefer setting `VARG_API_KEY` in your shell or a secret manager, review TSX/media files before cloud submission, and require explicit confirmation before any checkout or self-update step.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill goes beyond media generation and instructs the agent to initiate billing-related actions, including creating a Stripe checkout session via authenticated API calls. That expands the trust boundary from content generation into financial workflows, increasing the risk of unintended purchases, social engineering, or mishandling of purchase URLs and tokens if the agent acts without explicit, granular user confirmation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs appending `VARG_API_KEY` to a project `.env` file without warning that this stores a live credential on disk and may place it inside the project workspace. This can expose the key through source control, backups, shared directories, logs, or later tooling that reads project files, especially because the instruction appends blindly rather than checking whether `.env` is safe or ignored.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The OTP flow directs collection and transmission of the user's email address and one-time verification code to a remote service without an explicit privacy notice or minimization guidance. While this is a normal authentication flow, it still involves sensitive personal data and authentication factors, and users may not realize the agent is brokering those secrets to a third party.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to send locally authored TSX code and an API bearer credential to a third-party cloud service, but it does not explicitly warn that prompt content, embedded URLs, and any hardcoded data in the TSX will leave the local environment. In a skill context, users may paste sensitive business content or private media references into render code, so omission of a clear remote-data-handling notice creates a real privacy and credential-handling risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The webhook section describes sending job snapshots to a user-supplied URL but does not clearly warn that render metadata and output details will be POSTed to an external endpoint. This can cause unintended disclosure if users configure third-party webhook receivers or misunderstand what data is included in the callback.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs users to append a live API key directly into a local `.env` file without any warning about plaintext secret handling, file permissions, or ensuring the file is excluded from version control. While `.env` use is common, presenting it this way can lead to accidental credential exposure through commits, logs, backups, or shared workspaces.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This recipe encourages uploading recipient photos and processing personalized media without any privacy notice, consent guidance, retention limits, or handling restrictions. Because the workflow involves personal images and potentially sensitive biometric-like content, users may unknowingly transmit third-party data to cloud storage and external APIs in ways that create privacy, compliance, and unauthorized-use risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The template explicitly reads a local file (`video.tsx`) and transmits its full contents to a remote API for rendering, but the documentation does not warn users that their local code and embedded prompts/assets may leave the machine. In a skill focused on cloud rendering this behavior is expected, but the missing privacy/data-sharing disclosure can still cause unintentional exposure of sensitive content if users adapt the example to real projects.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The document instructs users to rely on `VARG_API_KEY` for both cloud and local workflows without any guidance on secure credential handling. While environment variables are standard, omission of basic warnings can lead to accidental leakage through shell history, logs, screenshots, shared scripts, or committed `.env` files.

External Transmission

Medium

• Category: Data Exfiltration

Content

TEMPLATE

# Submit to render service (requires jq)
JOB_ID=$(curl -s -X POST https://api.varg.ai/v2/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"code\": $(cat video.tsx | jq -Rs .)}" \

• Confidence: 95% confidence
• Finding: curl -s -X POST https://api.varg.ai/v2/render \ -H "Authorization: Bearer $VARG_API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

# Read TSX and escape it for JSON (no jq needed)
CODE=$(sed 's/\\/\\\\/g; s/"/\\"/g; s/$/\\n/' video.tsx | tr -d '\n' | sed 's/\\n$//')

RESPONSE=$(curl -s -X POST https://api.varg.ai/v2/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"code\": \"$CODE\"}")

• Confidence: 95% confidence
• Finding: curl -s -X POST https://api.varg.ai/v2/render \ -H "Authorization: Bearer $VARG_API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

);
TEMPLATE

curl -s -X POST https://api.varg.ai/v2/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"code\": $(cat talking-head.tsx | jq -Rs .)}"

• Confidence: 94% confidence
• Finding: curl -s -X POST https://api.varg.ai/v2/render \ -H "Authorization: Bearer $VARG_API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

TEMPLATE

# Submit to render service (requires jq)
JOB_ID=$(curl -s -X POST https://api.varg.ai/v2/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"code\": $(cat video.tsx | jq -Rs .)}" \

• Confidence: 95% confidence
• Finding: https://api.varg.ai/

External Transmission

Medium

• Category: Data Exfiltration

Content

# Read TSX and escape it for JSON (no jq needed)
CODE=$(sed 's/\\/\\\\/g; s/"/\\"/g; s/$/\\n/' video.tsx | tr -d '\n' | sed 's/\\n$//')

RESPONSE=$(curl -s -X POST https://api.varg.ai/v2/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"code\": \"$CODE\"}")

• Confidence: 95% confidence
• Finding: https://api.varg.ai/

External Transmission

Medium

• Category: Data Exfiltration

Content

);
TEMPLATE

curl -s -X POST https://api.varg.ai/v2/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"code\": $(cat talking-head.tsx | jq -Rs .)}"

• Confidence: 94% confidence
• Finding: https://api.varg.ai/

Credential Access

High

• Category: Privilege Escalation

Content

# Or manually:
# 1. Ensure VARG_API_KEY is in .env
echo "VARG_API_KEY=varg_xxx" >> .env

# 2. Quick smoke test
bunx vargai hello

• Confidence: 93% confidence
• Finding: .env

VirusTotal

52/52 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/setup.ts:32

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/setup.ts:43