Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this AI UGC ad video skill benign because the reported external services and media-generation workflow appear purpose-related, while noting installer supply-chain and data-sharing concerns.
Before installing, consider that the installer is not pinned to an exact version. Before using the skill, check whether you are comfortable sending product images, prompts, voice recordings, or other supplied media to external generation services. The scan covered all three listed components but was marked partial because one local path-like reference could not be resolved.
The installation command executes an unpinned npm package and installs skill content without an immutable revision. Although this is not an MCP server declaration, it presents a supply-chain risk: a compromised future release could execute code with the installing user's privileges or introduce malicious agent instructions.
The examples encourage supplying local product images without explaining that their contents and accompanying prompts will leave the user's environment. The named API and model providers make external processing foreseeable, but unpublished product assets or identifying details could still be disclosed without an informed data-sharing decision.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Open-source alternative to Arcads: AI UGC ads
An AI creator talks to camera about your product, holds it, uses it, and sounds like a person filming themselves. Generation runs on varg: the MCP (`call_tool`) or `POST https://api.varg.ai/v2/tools/{image|video|speech}/call`. Quote credits only, from `estimate_cost`, and wait for a yes before spending.
**What the data says:** in one operator's $100K test (220 videos), human UGC had the higher CTR and AI the higher ROAS, because AI made more variants cheaply. AI works for cold traffic, low-trust products and finding the winning angle; it is weak for high-ticket offers and warm audiences. The script matters more than whether the face is real. Use AI to find the angle, then consider remaking the winner with a real creator.
The workflow directs reference images, voice files, and transcripts to external generation services without a privacy or rights-confirmation gate. Synthetic creator assets reduce the usual personal-data exposure, but real product photographs and any user-supplied likeness or voice can contain confidential or identifying information; approval to spend credits does not explicitly address that disclosure.
The workflow instructs the agent to render a take and reuse reference imagery and audio with Seedance, including a character's appearance and dialogue recording. These inputs can contain identifiable face and voice data, but the file does not warn users that the rendering provider will receive them.