Security audit

how-to-make-ai-video

Security checks for vulnerabilities and agentic risk

Overview

The skill is rated suspicious because scanners report privacy gaps, repeated unpinned installation commands, and a workflow that requires storing project content in GitHub; the scan is partial.

Consider avoiding installation until the external data sharing is clearly disclosed, GitHub storage is optional and authorized, and installer versions and skill revisions are pinned and reviewed. The scan covered the three bundled Markdown components but was marked partial because several referenced local paths were missing; it does not establish that the skill is safe.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (19)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
each flag (duration, black or frozen frames, seams, sync, loudness, spelling on screen). A fresh agent reads only the flags. Takes rank on counted defects, and a person picks between close ones. | review.md | `media-judge`, QA checklist in `varg-video-prompting` | https://varg.ai/how-to/judge-an-ai-video-without-bias.md | | 10 | **Keep it in GitHub**: Set this up before step 1 and use it at every STOP: a private GitHub repo, text in git, media listed by hash with its bytes in Releases, keys in .env behind a commit hook. Save a version at every STOP so anything can be undone, and prove the backup restores byte for byte. | AGENTS.md, media.lock.jsonl | `video-project-github` | https://varg.ai/how-to/keep-a-video-project-in-github.md | Before each step, read its guide (the `.md` link) and install its skill (`npx skills add vargHQ/skills --skill <skill>`). Every claim in the guides is traced to its source in the evidence bank: https://varg.ai/how-to/guide-pages/evidence-bank/data/PLAYBOO

The search workflow lacks a privacy warning that video-request details are sent to an external service.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The described workflow turns a person's video request into an external search without stating which details leave the agent. Video briefs can contain confidential product plans or personal information, and the README provides no instruction to minimize that disclosure.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This is an unpinned npm installer invocation, not an MCP server reference as labeled. Running it can execute a newly published version of the skills package with the user's privileges, creating a supply-chain exposure if a release or publisher account is compromised.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The search workflow explicitly asks for the person's own words and sends the request to an external service that logs searches. Excluding IP addresses and keys does not prevent confidential brief details or personal information in the query from being retained.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
The answer is Markdown with the best-matching how-to page, the options to show the person, and the top skills with exact install commands for Claude Code, Codex, Cursor, OpenClaw and Gemini CLI. Add &limit=15 for more. For JSON (ranked cards with kind, slug, markdown, install), call the API:

bash
curl -s "https://api.varg.ai/v2/skills/search?q=<request>&limit=10&client=<your agent>"

Pass client (your agent's name) on every search. It is optional, but it shows varg which agents use the catalog, so it can rank better for them. Searches are logged without IP or key.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
## 4. Install the chosen skill and run it Use the install command from the page for the agent you are running in. Generation (images, video, voice, music, lip-sync, captions, render) runs on varg with one account: the `varg-ai` skill (`npx skills add vargHQ/skills --skill varg-ai`) or the varg MCP server `https://mcp.varg.ai/mcp` (OAuth sign-in, no key to paste). Quote the cost before a batch, a long video or a render (`estimate_cost` in the MCP, `POST https://api.varg.ai/v2/estimate` in the API). ## Whole video, start to finish

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The workflow directs the agent to run an unpinned npm installer and install mutable skill content. A compromised package release or repository update could therefore introduce code or agent instructions with access to the user's environment; this is a supply-chain issue rather than an MCP version issue.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The production rules repeat an executable installation command without fixing the npm package version or skill revision. Following it can run a compromised future installer release or introduce changed agent instructions.
Content: No source excerpt is available for this finding.

Mandates uploading project content to GitHub beyond the skill's discovery and production-routing purpose.

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: The workflow mandates uploading project text and media to GitHub before production, without separate authorization for that storage destination. A private repository reduces public exposure but does not establish consent to transfer confidential briefs, licensed assets, or personal media to another service.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The instruction mandates repeated installations through an unpinned npm executable and mutable repository. Applying this across many production steps increases exposure to compromised dependencies and unreviewed changes in agent behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
Agents that prefer tools over curl can add the public varg how to MCP server:

bash
claude mcp add --transport http varg-how-to https://api.varg.ai/v2/skills/mcp

It has two read-only tools: search_how_to {query} and get_how_to {kind, slug}. The second returns a page as Markdown. If the server is unreachable, use the curl calls above; they give the same results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
bash
[ -n "${VARG_API_KEY:-}" ] || export VARG_API_KEY=$(grep -o '"api_key"[^,}]*' ~/.varg/credentials 2>/dev/null | head -1 | cut -d'"' -f4) [ -n "$VARG_API_KEY" ] && curl -s -H "Authorization: Bearer $VARG_API_KEY" "https://api.varg.ai/v2/skills/me/search?q=<request>&client=<your agent>"

A 404 or 401 means the personal search is not available for this key. Fall back to the public search. In the varg MCP (https://mcp.varg.ai/mcp), search_skills signs in through OAuth and does the same: the agent authorizes itself in the browser, and no key is copied.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
bash
[ -n "${VARG_API_KEY:-}" ] || export VARG_API_KEY=$(grep -o '"api_key"[^,}]*' ~/.varg/credentials 2>/dev/null | head -1 | cut -d'"' -f4) [ -n "$VARG_API_KEY" ] && curl -s -H "Authorization: Bearer $VARG_API_KEY" "https://api.varg.ai/v2/skills/me/search?q=<request>&client=<your agent>"

A 404 or 401 means the personal search is not available for this key. Fall back to the public search. In the varg MCP (https://mcp.varg.ai/mcp), search_skills signs in through OAuth and does the same: the agent authorizes itself in the browser, and no key is copied.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The publishing workflow invokes an npm installer without a pinned version and installs a skill from a mutable repository. A compromised dependency could execute locally or alter publishing behavior, even though publishing itself is a legitimate feature.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

The full flow, with the one card format every listing uses: install the varg-publish-skill skill (npx skills add vargHQ/skills --skill varg-publish-skill).

In the varg MCP: the publish-skill prompt, then publish_skill. my_skills shows the review status.

With a key: POST https://api.varg.ai/v2/skills/submissions, with a JSON body like this:

bash
curl -s -X POST https://api.varg.ai/v2/skills/submissions \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

With a key: POST https://api.varg.ai/v2/skills/submissions, with a JSON body like this:

bash
curl -s -X POST https://api.varg.ai/v2/skills/submissions \ -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \ -d '{"name":"Lyric Video Maker","summary":"Turn a song into a karaoke-style lyric video for Reels.","source_url":"https://github.com/<you>/<repo>","install":"npx skills add <you>/<repo>","use_when":["make a lyric video","karaoke video for a song"],"tags":["lyric-video","music"],"via":"api"}'

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

The video-generation workflow lacks a warning that approved stills and prompts are sent to external model providers.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The workflow instructs the agent to generate video-model shots from approved stills, which sends project imagery and associated prompts to a third-party service. The required approval and cost estimate address spending, but do not disclose the privacy implications for confidential imagery or identifiable people.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Although this is a skill installer rather than an MCP server, the command runs an unpinned npm package and installs skill content from a mutable repository reference. A compromised package or upstream skill could introduce executable code or malicious agent instructions; the intended GitHub integration increases the potential exposure of project data and repository permissions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The general installation template invokes an unpinned npm CLI and selects skills from a mutable upstream repository. This is not an MCP configuration, but it creates a supply-chain trust boundary where compromised upstream code or instructions could execute commands or redirect the agent's behavior.
Content: No source excerpt is available for this finding.