ClawHub
Back to skill

Security audit

ai-ad-compliance-check

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious with medium confidence, mainly because its video-analysis workflow lacks a clear notice before sending videos to an external provider and grants broad tool access.

Before installing, consider whether you are comfortable sending videos or video URLs to Varg, especially unpublished or sensitive material, and with the broad tool access reported. Check the installer and skill source before use; scanning was partial because a local reference could not be resolved, so the evidence does not establish that every reference was reviewed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

The video-analysis workflow lacks an explicit warning that user video content is sent to an external service.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The README names the Varg API and account requirement but does not explicitly explain that analysis transfers video content to an external provider. Users checking unpublished ads could disclose confidential footage or personal information without understanding that data flow; external analysis is legitimate here, but warrants clear notice.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The installation example invokes an unpinned npm CLI and selects skill content without an immutable repository revision. Although this is not an MCP server declaration as the finding suggests, changed or compromised upstream releases could execute code or introduce malicious agent instructions during installation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
openclaw:
    requires:
      anyBins:
        - curl
    homepage: https://varg.ai/how-to
compatibility: >-
  Needs a VARG_API_KEY with curl (see the varg-ai skill) or the varg MCP connection

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Although the tools are enumerated rather than universally unrestricted, arbitrary curl arguments and unscoped file editing provide substantially more authority than a video audit needs. If the host treats these declarations as preauthorization, an injected instruction or agent error could use curl to transmit local files or modify unrelated files.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
compatibility: >-
  Needs a VARG_API_KEY with curl (see the varg-ai skill) or the varg MCP connection
  (https://mcp.varg.ai/mcp) for video_analyze. Optional: c2patool to read Content Credentials.
allowed-tools: Bash(curl:*) Bash(jq:*) Bash(c2patool:*) Read Write Edit WebFetch
---

# AI ad compliance check

The workflow sends ad videos to Varg for analysis without a privacy warning.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The workflow directs the agent to upload local files or submit video URLs to Varg without a privacy notice or authorization checkpoint for sensitive material. A request to check an unpublished ad does not necessarily authorize third-party disclosure of its footage, identifiable people, or access-bearing video URL.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

2. Pull everything said and shown

bash
curl -s -X POST https://api.varg.ai/v2/tools/video_analyze/call -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" -d '{"model":"video-analyze","video_url":"AD_URL",
  "prompt":"Audit this ad for compliance review: list every spoken claim and every on-screen claim with timestamps (prices, profit, results, guarantees, earnings, health, time-to-result, shipping promises); every person or face and whether it looks like a real person, a customer or an AI performer; any security-camera or caught-on-camera framing presented as real; before/after shots; landmarks, brands or characters visible; and any disclosure of AI use or paid partnership."}'

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
tion gets a matching piece of evidence or fails (`ftc-health-claims`, `ftc-earnings`).
2. **Product truth** (`tts-ai-effect`, `tts-ai-before-after`, `tts-ai-product-change`): effect, time span, quantity, size, accessories, install, compatibility match the listing.
3. **People and voices** (`ftc-fake-reviews`, `ny-synthetic-performer`, `meta-ai-info`): an AI person speaking in the first person about using the product → block; any AI person → visible disclosure; no real person's likeness or voice without consent.
4. **Framing** (`staged-real-footage`): CCTV, dashcam, news or "real customer" styling on AI footage needs the AI label.
5. **Platform specifics:** LIVE voice rules, ≥3 s moving footage for Shop videos, Meta health/appearance and personal-attribute copy.
6. **Disclosures:** TikTok Ads AI toggle, TikTok AI label, Meta AI info, YouTube synthetic box, in-video #ad / paid partnership for affiliates, EU label. Keep C2PA metadata (`c2patool video.mp4`); stripping it is itself a red fl

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/rules.json (reported line 19)May include surrounding context.

json
"source": "https://www.bebolddigital.com/news/tiktok-shop-listing-content-policy-enforcement" },
    { "id": "tts-ai-disclose", "platform": "tiktok-shop", "market": "US", "severity": "fix", "status": "secondary", "date": "2026-09-02",
      "rule": "Significant AI content must be disclosed; real people must not be impersonated.",
      "check": "AI label on; no real person's face or voice without consent.",
      "source": "https://www.auditsocials.com/blog/tiktok-shop-ai-generated-content-product-rules-us-2026" },
    { "id": "tts-live-voice", "platform": "tiktok-shop-live", "market": "US", "severity": "block", "status": "secondary", "date": "2026-05-23",
      "rule": "LIVE: no AI voices, pre-recorded narration or radio; speech must be real-time. Stills or loops at most 50% of the screen.",