Security checks across malware telemetry and agentic risk
The skill is mostly a legitimate paid media-generation integration, but it has review-worthy credential exposure and unpinned self-update behavior before use.
Install only if you trust Varg with media prompts, uploaded files, generated outputs, and any BYOK provider keys. Use a dedicated low-balance Varg key, do not let the agent print or paste raw secrets, avoid the unpinned update step unless you re-review the updated skill, confirm every paid render or credit package, and do not upload private photos or confidential project code unless public URLs and remote caching are acceptable.
TEMPLATE
# Submit to render service (requires jq)
JOB_ID=$(curl -s -X POST https://render.varg.ai/api/render \
-H "Authorization: Bearer $VARG_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"code\": $(cat video.tsx | jq -Rs .)}" \# Read TSX and escape it for JSON (no jq needed)
CODE=$(sed 's/\\/\\\\/g; s/"/\\"/g; s/$/\\n/' video.tsx | tr -d '\n' | sed 's/\\n$//')
RESPONSE=$(curl -s -X POST https://render.varg.ai/api/render \
-H "Authorization: Bearer $VARG_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"code\": \"$CODE\"}"));
TEMPLATE
curl -s -X POST https://render.varg.ai/api/render \
-H "Authorization: Bearer $VARG_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"code\": $(cat talking-head.tsx | jq -Rs .)}"65/65 vendors flagged this skill as clean.