Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this video-editing skill suspicious because its remote-processing fallback may share footage with a third party without clearly warning users, and its install instructions use unpinned packages; no clear malicious intent was reported.
Before installing, consider whether you are comfortable with a hosted option that may share footage or media URLs with Varg; use it only after understanding and agreeing to that sharing. The installation commands also use unpinned packages. Skillspector inspected all four listed components, but marked its analysis partial because several references did not resolve, so the evidence is incomplete.
The description emphasizes local operation but offers a remote fallback without explicitly explaining that a third party would receive or access the footage. An agent following that fallback could expose unpublished product material or identifiable creator footage without informed permission.
The command invokes an unpinned npm package through npx, potentially downloading and executing a changing release with the user's privileges. Although this is an installer rather than an MCP server, the underlying supply-chain exposure is real; there is no evidence the command itself is malicious.
The suggested npx invocation can download an unpinned ffmpeg-static package and run package installation code with the agent's privileges. This is not an MCP server reference, but it still introduces avoidable supply-chain risk into an otherwise local media-editing workflow.
The fallback instructs the agent to submit commands and media URLs to a hosted service without requiring permission to disclose the footage. Naming the service and mentioning credit estimates does not establish informed consent for third-party access, particularly for private or unreleased footage.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## No shell? Run it on varg
Send the same command to the varg `ffmpeg` tool (MCP `call_tool`, or `POST https://api.varg.ai/v2/ffmpeg`). Inputs and outputs are URLs. It is priced in credits, with an estimate before anything runs.
## Related skills