Security audit
Security checks for vulnerabilities and agentic risk
The skill is marked suspicious because it sends video content or URLs to Varg for analysis without a clear privacy warning, and its installer uses an unpinned npm package; the scans found no clear malicious intent.
Treat this as a review-before-install skill, not a finding of malicious intent. Before using it, check whether you are comfortable sending footage and URLs to Varg, especially private material or URLs with access tokens; the scan reports no clear disclosure or confirmation step. Installation also runs an unpinned npm package. The scan was partial because several local references were missing, so evidence about the complete artifact is incomplete.
The installation command executes an unpinned npm package through npx, allowing the code executed during installation to change without changes to this README. This is a supply-chain exposure rather than an unpinned MCP server, as the finding labels it; exploitation would require a malicious or compromised package release.
The README advertises analysis of a local video without explicitly explaining that its contents will leave the user's environment for third-party processing. References to the Varg API provide some notice, but do not establish informed authorization to upload potentially confidential local footage; the risk is substantially lower for public competitor ads.
The workflow directs the agent to upload reference videos and submit their URLs to Varg without a privacy check or confirmation for nonpublic material. Public competitor ads make most intended uses low sensitivity, but private footage or URLs containing access tokens could expose confidential information to the external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Download with media-download (vdl <url>), upload (POST /v2/files or create_upload), then:
curl -s -X POST https://api.varg.ai/v2/tools/video_analyze/call -H "Authorization: Bearer $VARG_API_KEY" \
-H "Content-Type: application/json" -d '{"model":"video-analyze","video_url":"AD_URL",
"prompt":"Break this competitor product ad down for a remix: every shot with start-end seconds, camera and what happens; all on-screen text with timings; audio; the hook in the first 3 seconds; the angle (which pain or desire it sells), the format, the offer, the proof moment and the CTA; and the awareness level of the viewer it targets."}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Download with media-download (vdl <url>), upload (POST /v2/files or create_upload), then:
curl -s -X POST https://api.varg.ai/v2/tools/video_analyze/call -H "Authorization: Bearer $VARG_API_KEY" \
-H "Content-Type: application/json" -d '{"model":"video-analyze","video_url":"AD_URL",
"prompt":"Break this competitor product ad down for a remix: every shot with start-end seconds, camera and what happens; all on-screen text with timings; audio; the hook in the first 3 seconds; the angle (which pain or desire it sells), the format, the offer, the proof moment and the CTA; and the awareness level of the viewer it targets."}'