ClawHub
Back to skill

Security audit

varg-ai

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for Varg AI media generation, but its setup and update instructions can expose API keys and run mutable third-party code.

Review this skill before installing. Use it only if you are comfortable uploading prompts, TSX code, asset references, and generated media to varg.ai and spending paid credits. Do not run the raw credential-printing check, avoid appending secrets to `.env` unless it is gitignored, prefer secure or temporary key storage, and require explicit approval before self-updates, package installs, payments, or full paid renders.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/setup.sh:187
Finding
Unverified Remote Installer Piped Directly to Bash<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:187` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash dim " curl -fsSL https://bun.sh/install | bash" ``` ### Technical Analysis The setup script recommends downloading a mutable remote installation script and piping it directly into Bash. Although this command is displayed as an instruction rather than automatically executed by `setup.sh`, it is part of the prescribed setup flow and creates a direct remote code-execution channel. HTTPS authenticates the server connection but does not pin the returned artifact. The effective code executed by the user can therefore change after this Skill has been reviewed. A compromise of the remote server, CDN, DNS resolution, publication process, or upstream account could replace the installer with arbitrary shell commands. The command provides no version pin, checksum validation, signature verification, or opportunity to inspect the downloaded content before execution. ### Attack Path 1. An attacker compromises the Bun installer publication account, hosting infrastructure, CDN, or another part of its distribution chain. 2. The content returned from `https://bun.sh/install` is replaced with malicious shell code. 3. A user follows the setup recommendation and runs the displayed command. 4. `curl` downloads the attacker-controlled response. 5. Bash executes the response immediately with the user's current permissions. 6. The payload can access project files, environment variables, Varg credentials, and other data available to that user. ### Impact Assessment Successful exploitation grants arbitrary command execution with the privileges of the user running the installer. This can expose API keys, source code, personal files, and local account data. The payload could also modify shell configuration or install persistence where the user's permissions permit it. No evidence establis ...[truncated 120 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Do not pipe downloaded content directly into a shell. - Prefer a trusted operating-system package manager where available. - Download a version-pinned installer or release artifact to a local file. - Verify the artifact against an independently published cryptographic checksum or signature. - Allow the user to inspect the downloaded script before executing it. - Document the exact expected version and trusted signing identity. - Run installation with the lowest privileges possible and never recommend unnecessary elevation. A safer workflow is: ```bash curl -fL -o bun-install.sh "PINNED_RELEASE_URL" printf '%s %s\n' "EXPECTED_SHA256" "bun-install.sh" | sha256sum -c - less bun-install.sh bash bun-install.sh ``` ]]>

T08 · Insecure Dependencies

Error
Location
SKILL.md:37
Finding
Unpinned Package Execution in Automatic Skill Update Flow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37-43` **Vulnerability Type**: Insecure dependency and update mechanism **Risk Level**: High ### Vulnerable Code ```bash curl -sf https://raw.githubusercontent.com/vargHQ/skills/main/varg-ai/SKILL.md | grep 'version:' | head -1 ``` ```bash npx -y skills update ``` ### Technical Analysis The Skill requires an update check during each session and directs the agent to run an unpinned `npx` package when a remote version appears newer. The package version and artifact integrity are not fixed by the Skill, and `-y` suppresses confirmation. The update decision trusts a mutable file fetched from a repository branch. The command checks only a textual version field and does not authenticate a release signature, commit identity, or expected content hash. The subsequent `npx` command may download and execute the current registry version of `skills`, including package lifecycle or runtime code. This creates both a dependency supply-chain risk and a mechanism by which reviewed Skill instructions can be replaced with newer, unreviewed content. ### Attack Path 1. An attacker compromises the package registry account, repository account, update infrastructure, or an accepted upstream release. 2. The remote Skill file advertises a version newer than `2.0.4`, or a malicious version of the `skills` package becomes the default registry resolution. 3. The agent follows the mandatory update instructions. 4. `npx -y` retrieves and executes the unpinned package without confirmation. 5. Malicious package code executes locally or installs attacker-controlled Skill instructions. 6. The modified instructions or package code can access resources available to the agent and user. ### Impact Assessment A compromised update can execute commands with the invoking user's permissions and replace trusted Skill instructions. Potentially exposed resources include project source files, environment variables, API credentials, gene ...[truncated 238 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pin the updater to an exact package version, for example `skills@X.Y.Z`. - Use a committed lockfile and enforce integrity hashes. - Verify Skill releases using signed tags, signed manifests, or pinned commit hashes. - Do not infer trust solely from a version string in a mutable branch. - Remove `-y` from security-sensitive update operations. - Require explicit user approval before replacing Skill instructions. - Download updates to a staging location, verify them, show a change summary, and only then install them. - Re-audit updated Skill files before they are loaded or executed. ]]>

T08 · Insecure Dependencies

Error
Location
references/local-render.md:101
Finding
Unpinned Varg CLI Packages Executed Through bunx<![CDATA[ ## Vulnerability Details **File Location**: `references/local-render.md:101-109` **Vulnerability Type**: Insecure dependency execution **Risk Level**: High ### Vulnerable Code ```bash # Preview with free placeholders (validate structure before paying) bunx vargai render video.tsx --preview # Full render (costs credits) bunx vargai render video.tsx --verbose # Force regeneration (bypass cache -- use sparingly, costs $$$) bunx vargai render video.tsx --no-cache ``` Related unpinned `bunx vargai` commands also appear in `SKILL.md`, `scripts/setup.sh`, `scripts/setup.ts`, and `references/templates.md`. ### Technical Analysis The operational workflow repeatedly executes `vargai` through `bunx` without specifying an exact version or enforcing a lockfile and integrity metadata. Depending on local package state and Bun resolution behavior, `bunx` can retrieve and execute package content from a registry. Package code runs locally and is expected to receive `VARG_API_KEY` through the environment. Full rendering also processes local TSX and media files. A compromised package publication account, malicious release, or registry resolution attack could therefore convert a normal render command into local arbitrary code execution and credential theft. The `--no-cache` command also triggers billable regeneration, but the primary security issue is unverified package execution. ### Attack Path 1. An attacker publishes or substitutes a malicious package version accepted by unpinned `bunx vargai` resolution. 2. A user or agent invokes one of the documented render commands. 3. Bun downloads and executes the malicious package. 4. The package reads environment variables such as `VARG_API_KEY` and accesses local project files. 5. The package can exfiltrate data or execute additional commands using the current user's privileges. ### Impact Assessment Successful exploitation can expose Varg credentials, provider API keys loaded from `.env`, project source code, inp ...[truncated 300 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Declare `vargai` as an exact-version project dependency. - Commit a Bun lockfile and require frozen-lockfile installation. - Validate registry integrity metadata before execution. - Invoke the locally installed, locked package rather than allowing on-demand resolution. - Separate dependency installation from rendering and obtain explicit approval before installing or upgrading packages. - Run rendering in a constrained environment with access only to required files and variables. - Pass only `VARG_API_KEY` when necessary rather than exposing the entire inherited environment. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:54
Finding
Authentication Check Prints Raw Credentials to Agent-Visible Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:54` **Vulnerability Type**: Sensitive credential disclosure **Risk Level**: High ### Vulnerable Code ```bash echo "${VARG_API_KEY:-}" && cat ~/.varg/credentials 2>/dev/null ``` ### Technical Analysis The required authentication check prints the raw `VARG_API_KEY` environment variable and then prints the complete contents of `~/.varg/credentials`. Because agent command output can be captured in conversation context, execution logs, telemetry, shell transcripts, or debugging records, this directly discloses the credential. The behavior is unnecessary for determining whether authentication is configured. A presence test or a parser that returns only a boolean status is sufficient. It also contradicts the Skill's later rule that API key values must not be exposed in commands or conversation context. If both sources exist, the command can disclose two copies of the credential and any additional fields in the credentials file, including the account email and creation timestamp. ### Attack Path 1. A user has `VARG_API_KEY` set or has saved credentials in `~/.varg/credentials`. 2. The agent follows the required setup instruction. 3. The shell writes the raw environment key and credential file to command output. 4. The output is retained in agent context, logs, telemetry, or terminal history. 5. A party with access to those records retrieves and reuses the key. ### Impact Assessment A disclosed Varg API key can be used to submit billable rendering or generation requests and access API resources authorized for that key. This can result in unauthorized credit consumption and exposure of account-associated jobs or files where permitted by the API. The command does not obtain elevated operating-system privileges, but it violates least disclosure and exposes a billing-capable secret. ]]>
Remediation
<![CDATA[ ## Remediation Suggestions Replace output-based checks with boolean presence checks: ```bash if [ -n "${VARG_API_KEY:-}" ]; then echo "VARG_API_KEY is configured" elif [ -f "$HOME/.varg/credentials" ] && grep -q '"api_key"[[:space:]]*:' "$HOME/.varg/credentials"; then echo "Saved Varg credentials are configured" else echo "Varg credentials are not configured" fi ``` Additional controls: - Never print complete credential files. - Redact API keys and access tokens from all command output. - Ensure authentication responses containing `api_key` or `access_token` are not logged. - Add secret-redaction tests for setup instructions and scripts. - Return only status information such as configured, missing, valid, or invalid. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:92
Finding
API Key Duplicated into Plaintext Global and Project Credential Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:92-111` **Vulnerability Type**: Insecure plaintext secret storage **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p ~/.varg && echo "{\"api_key\":\"$VARG_API_KEY\",\"email\":\"USER_EMAIL\",\"created_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > ~/.varg/credentials && chmod 600 ~/.varg/credentials ``` ```bash curl -s -H "Authorization: Bearer $VARG_API_KEY" https://api.varg.ai/v2/billing/balance ``` ```bash echo "VARG_API_KEY=$VARG_API_KEY" >> .env ``` ### Technical Analysis The workflow stores the API key in plaintext under the user's home directory and then duplicates it into a project-level `.env` file. The global file is eventually assigned mode `600`, but the command does not securely create the directory and file from the outset, does not set a restrictive `umask`, and does not use atomic creation. The project `.env` operation applies no permission control, does not verify that `.env` is excluded from version control, and blindly appends duplicate entries. Project files are more likely to be committed, copied, archived, uploaded, or shared. The JSON is constructed through direct shell interpolation rather than a JSON serializer. Unexpected quote, backslash, or newline characters in substituted fields could corrupt the credentials file. Credential persistence is useful for the declared functionality, but duplicating the key into multiple plaintext locations is not the minimum-privilege or minimum-exposure design. ### Attack Path 1. The user authenticates and obtains a valid Varg API key. 2. The Skill writes the key to `~/.varg/credentials`. 3. If a project `.env` exists, the Skill appends another plaintext copy. 4. The `.env` file is committed, backed up, shared, or read by another local process. 5. An unauthorized party obtains the key and uses it against the Varg API. A local attacker with access to the user's files could also retrieve the global plaintext credential. ### ...[truncated 404 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Prefer an operating-system keychain or dedicated secret manager. - Do not automatically duplicate a global credential into each project. - Require explicit user consent before creating project-level secret files. - Ensure `.env` is listed in `.gitignore` before writing to it. - Create credential files atomically under a restrictive `umask`, for example `umask 077`. - Set restrictive permissions before or during file creation rather than afterward. - Use a proper JSON serializer instead of shell interpolation. - Replace existing key entries safely instead of blindly appending duplicates. - Document credential rotation and deletion procedures. - Warn users not to commit, upload, or share credential files. ]]>

other

Warning
Location
scripts/setup.ts:87
Finding
Setup Script Unnecessarily Reads Unselected Third-Party Provider Secrets<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.ts:87-92` **Vulnerability Type**: Sensitive environment reconnaissance **Risk Level**: Medium ### Vulnerable Code ```ts let vargKey = checkEnvKey("VARG_API_KEY") const savedCreds = checkSavedCredentials() const falKey = checkEnvKey("FAL_KEY") || checkEnvKey("FAL_API_KEY") const elevenKey = checkEnvKey("ELEVENLABS_API_KEY") const replicateKey = checkEnvKey("REPLICATE_API_TOKEN") const higgsfieldKey = checkEnvKey("HIGGSFIELD_API_KEY") ``` The helper returns the actual environment value rather than a boolean: ```ts function checkEnvKey(name: string): string | undefined { // Check process.env (Bun auto-loads .env) return process.env[name] || undefined } ``` ### Technical Analysis The TypeScript setup process reads and retains the values of several third-party provider credentials even when the user is using the default Varg gateway and has not selected a bring-your-own-key workflow. The values are not printed, and the audit found no code that transmits these provider keys over the network. Only `vargKey` is sent by `checkGateway()` to the declared `https://api.varg.ai/v2/billing/balance` endpoint. Nevertheless, reading unrelated secrets into process variables expands the sensitive-data exposure surface beyond what is needed for default setup. Because Bun automatically loads `.env`, invoking the setup script can make every listed provider key available to the process without explicit user action. ### Attack Path 1. A project `.env` or inherited shell environment contains one or more provider credentials. 2. The user runs `bun scripts/setup.ts` only to configure or test Varg. 3. The script reads all listed provider credentials and retains their full values in process memory. 4. A compromised runtime, dependency, debugger, crash collector, or later modification to the script gains access to those values. 5. The additional provider credentials may then be disclosed or misused. No direct ...[truncated 598 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Read only `VARG_API_KEY` during the default gateway setup. - Ask the user to select a BYOK provider before probing that provider's environment variable. - For presence checks, retain only a boolean rather than the secret value: ```ts function hasEnvKey(name: string): boolean { return typeof process.env[name] === "string" && process.env[name]!.length > 0 } ``` - Scope secret values to the smallest possible block and clear references when no longer needed. - Pass only required environment variables to subprocesses. - Avoid loading an entire project `.env` during capability detection when a narrower configuration source is available. - Add tests confirming that setup does not access unrelated provider credentials in gateway-only mode. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (74)

Credential Access

High
Category
Privilege Escalation
Content
Also add to the project `.env` if one exists:

```bash
echo "VARG_API_KEY=$VARG_API_KEY" >> .env
```

**Check balance and add credits**
Confidence
99% confidence
Finding
Appending `VARG_API_KEY` directly to `.env` stores a live credential in a project file that may be committed to source control, copied into artifacts, exposed to collaborators, or read by other tools. In an agent workflow this is especially risky because the action is automated and may occur without the user's full awareness.

Ae1

High
Category
analysis-evasion
Content
| Full examples | [templates.md](references/templates.md) | Need complete copy-paste-ready templates |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `job_id` field | `id` field |
| `output.url` (single) | `output.outputs[]` (array, each with `file_id`) |
| `GET /jobs/{id}/stream` (SSE) | Removed — poll or `options.webhook_url` |
| `DELETE /jobs/{id}` | `POST /jobs/{id}/cancel` |
| `GET /balance` | `GET /billing/balance` |
| `GET /usage` | `GET /billing/usage` |
| `POST /ffmpeg/trim` etc. | Single `POST /ffmpeg`, op selected by `model` |
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High
Category
Privilege Escalation
Content
bun scripts/setup.ts

# Or manually:
# 1. Ensure VARG_API_KEY is in .env
echo "VARG_API_KEY=varg_xxx" >> .env

# 2. Quick smoke test
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
bun scripts/setup.ts

# Or manually:
# 1. Ensure VARG_API_KEY is in .env
echo "VARG_API_KEY=varg_xxx" >> .env

# 2. Quick smoke test
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
bun scripts/setup.ts

# Or manually:
# 1. Ensure VARG_API_KEY is in .env
echo "VARG_API_KEY=varg_xxx" >> .env

# 2. Quick smoke test
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
bun scripts/setup.ts

# Or manually:
# 1. Ensure VARG_API_KEY is in .env
echo "VARG_API_KEY=varg_xxx" >> .env

# 2. Quick smoke test
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Credential Access

High
Category
Privilege Escalation
Content
echo ""
  echo "  Then set it:"
  echo "    $(cyan 'export VARG_API_KEY=varg_xxx')"
  echo "    $(dim 'echo VARG_API_KEY=varg_xxx >> .env')"
  echo ""
  echo "  Or save globally:"
  echo "    $(dim "mkdir -p ~/.varg && echo '{\"api_key\":\"varg_xxx\"}' > ~/.varg/credentials && chmod 600 ~/.varg/credentials")"
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High
Category
Supply Chain
Content
dim "    bunx vargai render video.tsx --verbose   (full render)"
  echo ""
  echo "  Cloud render (via API):"
  echo "  $(dim '  curl -X POST https://api.varg.ai/v2/render \')"
  echo "  $(dim '    -H "Authorization: Bearer $VARG_API_KEY" \')"
  echo "  $(dim '    -H "Content-Type: application/json" \')"
  echo "  $(dim '    -d '\''{"code": "..."}'\''')"
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp1

High
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The script makes an outbound network request to https://api.varg.ai/v2/billing/balance to validate the API key, but the network capability is not declared in permissions. In a skill ecosystem, undeclared network access is risky because it can exfiltrate data or contact remote services outside the user's expected trust boundary.

Lp1

High
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The script makes an outbound network request to https://api.varg.ai/v2/billing/balance to validate the API key, but the network capability is not declared in permissions. In a skill ecosystem, undeclared network access is risky because it can exfiltrate data or contact remote services outside the user's expected trust boundary.

Credential Access

High
Category
Privilege Escalation
Content
const hasPackageJson = await Bun.file("package.json").exists()
const hasTsconfig = await Bun.file("tsconfig.json").exists()
const hasEnv = await Bun.file(".env").exists()

if (hasPackageJson) console.log(green("  ✓ package.json exists"))
else console.log(yellow(`  ○ No package.json`))
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list contains broad phrases like 'generate image' and 'text to speech' that may cause the skill to activate in situations where the user did not intend to invoke this external-service workflow. That increases the chance of unnecessary network calls, credential handling, or cost-incurring actions being suggested or initiated.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding
The skill instructs the agent to run `npx -y skills update` without pinning a specific package version or integrity, which can execute whatever code is currently published under that package name. In an agent context, this creates a supply-chain execution path where remote code can change over time and be run automatically before subsequent steps.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
export VARG_API_KEY=<their_key>
```

**Important:** Do NOT ask the user to paste the raw key to you. Ask them to run the `export` command themselves. Then skip to "Save credentials" below.

**Option B: Sign up / sign in via email (OTP)**
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

External Transmission

Medium
Category
Data Exfiltration
Content
1. Ask the user for their **email address**.
2. Send a one-time code to their email:
```bash
curl -s -X POST https://app.varg.ai/api/auth/cli/send-otp \
  -H "Content-Type: application/json" \
  -d '{"email":"USER_EMAIL"}'
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill tells the agent to persist `VARG_API_KEY` to `~/.varg/credentials` and append it to `.env` without a strong warning about long-term storage, repository leakage, shell history exposure, or multi-user system risks. Persisting live API credentials expands the attack surface well beyond the immediate session.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
Once `VARG_API_KEY` is set (from either option), save it globally and verify. Always reference `$VARG_API_KEY` -- never the raw value:

```bash
mkdir -p ~/.varg && echo "{\"api_key\":\"$VARG_API_KEY\",\"email\":\"USER_EMAIL\",\"created_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > ~/.varg/credentials && chmod 600 ~/.varg/credentials
```

Verify the key works:
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium
Category
Rogue Agent
Content
Once `VARG_API_KEY` is set (from either option), save it globally and verify. Always reference `$VARG_API_KEY` -- never the raw value:

```bash
mkdir -p ~/.varg && echo "{\"api_key\":\"$VARG_API_KEY\",\"email\":\"USER_EMAIL\",\"created_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > ~/.varg/credentials && chmod 600 ~/.varg/credentials
```

Verify the key works:
Confidence
96% confidence
Finding
Persisting the API key in `~/.varg/credentials` creates session persistence for a sensitive token, increasing exposure to local compromise, backup leakage, multi-user access mistakes, and unintended reuse by future processes. The skill makes this persistence the default rather than an opt-in choice.

External Transmission

Medium
Category
Data Exfiltration
Content
- **If you have the `access_token`** (from Option B email OTP), capture it and create a Stripe checkout session:
```bash
VARG_ACCESS_TOKEN=$(echo "$VARG_AUTH" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)
curl -s -X POST https://app.varg.ai/api/billing/checkout \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $VARG_ACCESS_TOKEN" \
  -H "Origin: https://app.varg.ai" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Submit TSX code to the render service — returns a job: {"id": "job_xxx", "status": "queued", ...}
curl -s -X POST https://api.varg.ai/v2/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code": "const img = Image({ model: varg.imageModel(\"nano_banana_pro\"), prompt: \"a cabin in mountains at sunset\", aspectRatio: \"16:9\" });\nexport default (<Render width={1920} height={1080}><Clip duration={3}>{img}</Clip></Render>);"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
One `VARG_API_KEY`, all providers, metered billing:

```bash
curl -X POST https://api.varg.ai/v2/image \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "nano_banana_pro", "prompt": "a sunset over mountains"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The document instructs users to send TSX code, prompts, and assets to a remote API using their API key, but it does not clearly warn that this transmits potentially sensitive creative content and embedded URLs to an external service. In a skill context, omission of that disclosure can lead users to unknowingly exfiltrate proprietary or private material to cloud infrastructure.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 2: Submit to render service

```bash
curl -s -X POST https://api.varg.ai/v2/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"code\": $(cat video.tsx | jq -Rs .)}"
Confidence
93% confidence
Finding
This command posts the contents of a local TSX file to an external render API while authenticating with the user's API key. That is expected for cloud rendering, but without prominent consent/disclosure it creates a real risk of sending sensitive source content, prompts, or internal asset references off-host.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/setup.ts:32

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
scripts/setup.ts:43