Security audit
Security checks for vulnerabilities and agentic risk
This media-generation skill needs review because it requests broadly scoped skill updates and automatically saves API keys beyond their original location.
Before installing, require updates to be reviewed and limited to this skill. Choose explicitly where the API key may be saved, and protect any credential files. Prompts, reference media, and speech text use remote generation services even with local rendering, and generation consumes credits. The Review verdict rests on update scope and automatic credential copying, not the scanner's critical score; the supplied static scan reported no findings.
The security-relevant mismatch is the instruction to execute a skill updater and re-read changed instructions as part of a media-generation session. This crosses from using the installed skill into modifying executable instructions, potentially affecting more than this skill depending on the updater's scope.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
[ -n "${VARG_API_KEY:-}" ] || VARG_API_KEY=$(grep -o '"api_key"[^,}]*' ~/.varg/credentials 2>/dev/null | head -1 | cut -d'"' -f4)
[ -n "${VARG_API_KEY:-}" ] || VARG_API_KEY=$(grep -hE '^(export )?VARG_API_KEY=' .env .env.local 2>/dev/null | head -1 | cut -d= -f2- | tr -d "\"' \r")
export VARG_API_KEY
if [ -n "$VARG_API_KEY" ]; then
curl -s -o /dev/null -w "key found -- HTTP %{http_code} (200 = valid, 401 = invalid)\n" -H "Authorization: Bearer $VARG_API_KEY" https://api.varg.ai/v2/billing/balance
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
[ -n "${VARG_API_KEY:-}" ] || VARG_API_KEY=$(grep -o '"api_key"[^,}]*' ~/.varg/credentials 2>/dev/null | head -1 | cut -d'"' -f4)
[ -n "${VARG_API_KEY:-}" ] || VARG_API_KEY=$(grep -hE '^(export )?VARG_API_KEY=' .env .env.local 2>/dev/null | head -1 | cut -d= -f2- | tr -d "\"' \r")
export VARG_API_KEY
if [ -n "$VARG_API_KEY" ]; then
curl -s -o /dev/null -w "key found -- HTTP %{http_code} (200 = valid, 401 = invalid)\n" -H "Authorization: Bearer $VARG_API_KEY" https://api.varg.ai/v2/billing/balance
The command automatically copies a credential into a project file without checking or restricting that file's permissions. Being gitignored does not prevent other local users, project tooling, backups, or synchronized folders from reading the added secret.
For local render (bun auto-loads .env), also add it to the project .env -- only if that file exists, is gitignored, and has no key yet:
[ -f .env ] && git check-ignore -q .env 2>/dev/null && ! grep -q '^VARG_API_KEY=' .env && echo "VARG_API_KEY=$VARG_API_KEY" >> .env
Check balance and add credits
This is a duplicate match on the automatic credential write to .env. The gitignore check addresses accidental Git inclusion but does not establish that the destination is private or appropriate for secret storage.
For local render (bun auto-loads .env), also add it to the project .env -- only if that file exists, is gitignored, and has no key yet:
[ -f .env ] && git check-ignore -q .env 2>/dev/null && ! grep -q '^VARG_API_KEY=' .env && echo "VARG_API_KEY=$VARG_API_KEY" >> .env
Check balance and add credits
This finding identifies the same credential-replication weakness as the other matches on this line. Appending a secret to an existing file preserves potentially permissive access rights and broadens the secret's exposure beyond its original location.
For local render (bun auto-loads .env), also add it to the project .env -- only if that file exists, is gitignored, and has no key yet:
[ -f .env ] && git check-ignore -q .env 2>/dev/null && ! grep -q '^VARG_API_KEY=' .env && echo "VARG_API_KEY=$VARG_API_KEY" >> .env
Check balance and add credits
This is another duplicate of the unsafe default persistence into .env, not a separate attack path. An ignored project file can still be shared, backed up, or readable by other users, exposing the API key.
For local render (bun auto-loads .env), also add it to the project .env -- only if that file exists, is gitignored, and has no key yet:
[ -f .env ] && git check-ignore -q .env 2>/dev/null && ! grep -q '^VARG_API_KEY=' .env && echo "VARG_API_KEY=$VARG_API_KEY" >> .env
Check balance and add credits
Although updating is conditional on finding a newer version, the skill directs the agent to run an updater and trust the replacement instructions without approval or review. Compromise of the remote repository or update distribution could therefore turn an ordinary media request into execution of attacker-controlled code or instructions.
The command npx -y skills update can download and execute an unpinned npm package with the agent's filesystem and environment access. A compromised release could steal credentials or modify files; this is an npm supply-chain issue, not an MCP server configuration issue.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[ -n "${VARG_API_KEY:-}" ] || VARG_API_KEY=$(grep -hE '^(export )?VARG_API_KEY=' .env .env.local 2>/dev/null | head -1 | cut -d= -f2- | tr -d "\"' \r")
export VARG_API_KEY
if [ -n "$VARG_API_KEY" ]; then
curl -s -o /dev/null -w "key found -- HTTP %{http_code} (200 = valid, 401 = invalid)\n" -H "Authorization: Bearer $VARG_API_KEY" https://api.varg.ai/v2/billing/balance
else
echo "no key found"
fi
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
> 2. Generate an API key and copy it.
> 3. Run this in your terminal and paste the key when prompted -- it stays out of this chat and your shell history:
> ```bash
> mkdir -p ~/.varg && printf 'varg API key: ' && read -rs K && echo && (umask 077 && printf '{"api_key":"%s"}\n' "$K" > ~/.varg/credentials) && unset K
> ```
> Tell me when it's done.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
> ```
> Tell me when it's done.
When they reply, re-run the step 1 block. Do NOT ask the user to paste the raw key into the chat, and don't ask them to `export` it -- an `export` in their terminal doesn't reach your already-running shell, but the credentials file does.
### 1b. Save the key for next time
The workflow automatically converts a potentially temporary or project-scoped key into a persistent home-directory credential without an explicit storage choice. Although the restrictive umask reduces file-access risk, subsequent sessions in other projects can discover and use the copied key, extending its lifetime and scope.
If the key came from the environment or .env, save it to ~/.varg/credentials so future sessions find it (skipped if the file already exists). Always reference $VARG_API_KEY -- never the raw value:
[ -f ~/.varg/credentials ] || (mkdir -p ~/.varg && umask 077 && printf '{"api_key":"%s"}\n' "$VARG_API_KEY" > ~/.varg/credentials)
For local render (bun auto-loads .env), also add it to the project .env -- only if that file exists, is gitignored, and has no key yet:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Check balance and add credits
curl -s -H "Authorization: Bearer $VARG_API_KEY" https://api.varg.ai/v2/billing/balance
You should get {"available": ..., "total_balance": ..., ...} (values in credits). If available is 0 (or too low for the user's task), the user needs credits before generating anything. A typical short video costs 200-500 credits.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Submit TSX code to the render service — returns a job: {"id": "job_xxx", "status": "queued", ...}
curl -s -X POST https://api.varg.ai/v2/render \
-H "Authorization: Bearer $VARG_API_KEY" \
-H "Content-Type: application/json" \
-d '{"code": "const img = Image({ model: varg.imageModel(\"nano_banana_2_1\"), prompt: \"a cabin in mountains at sunset\", aspectRatio: \"16:9\" });\nexport default (<Render width={1920} height={1080}><Clip duration={3}>{img}</Clip></Render>);"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"code": "const img = Image({ model: varg.imageModel("nano_banana_2_1"), prompt: "a cabin in mountains at sunset", aspectRatio: "16:9" });\nexport default ({img});"}'
curl -s https://api.varg.ai/v2/jobs/JOB_ID
-H "Authorization: Bearer $VARG_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For one-off images, videos, speech, or music without building a multi-clip template:
curl -X POST https://api.varg.ai/v2/image \
-H "Authorization: Bearer $VARG_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model": "nano_banana_2_1", "prompt": "a sunset over mountains"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Cost & Iteration
- **Prices are in credits.** Typical prices: nano_banana_2_1 image ≈ 8, gpt_image_2_5 (high) ≈ 23, seedance_2_5 5s 720p ≈ 210, wan_3 5s 720p ≈ 53, eleven_v4 line ≈ 84, mureka_9_5 track ≈ 25. Live catalog: `GET https://api.varg.ai/v2/pricing` (no auth). Every model spec: `https://varg.ai/models/llms.txt`. Estimate any request: `POST /v2/estimate`.
- **Cache saves credits.** Keep unchanged prompts character-for-character identical across iterations.
- **Preview first** (local mode only): `--preview` generates free placeholders to validate structure.
- Full pricing: [models.md](references/models.md)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
_v2_5: ONLY 5 or 10. Check [models.md](references/models.md).
6. **Native audio = `audio: "native"`** on `Video()`. Provider options must be **namespaced by provider**: `providerOptions: { varg: { fal: { ... } } }`. A flat `providerOptions: { varg: { generate_audio: true } }` is silently dropped by the API, and you get a silent video.
7. **Renders cost credits** -- a typical 3-clip video costs ~300-800 credits depending on the video model (wan_3 vs seedance_2_5). Iterate with `--preview` (local), cheap draft models (`minimax_h3_max_turbo`, `grok_imagine_1_5_lite`) and 720p. Render 1080p only for the final.
8. **API key hygiene** -- Never write a raw API key value into a bash command. Load keys into `$VARG_API_KEY` with the setup snippets (from env, `~/.varg/credentials`, or `.env`) and use `$VARG_API_KEY` in all subsequent commands -- never `echo` or `cat` the key itself. This prevents keys from leaking into conversation context and terminal history.
### Default Models (October 2026)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Submit TSX code to the render service — returns a job: {"id": "job_xxx", "status": "queued", ...}
curl -s -X POST https://api.varg.ai/v2/render \
-H "Authorization: Bearer $VARG_API_KEY" \
-H "Content-Type: application/json" \
-d '{"code": "const img = Image({ model: varg.imageModel(\"nano_banana_2_1\"), prompt: \"a cabin in mountains at sunset\", aspectRatio: \"16:9\" });\nexport default (<Render width={1920} height={1080}><Clip duration={3}>{img}</Clip></Render>);"}'
The workflow directs both cloud and local rendering to use varg's model APIs, including for prompts, reference images, and speech text. Although API routing is described, the skill does not instruct the agent to warn users that their content leaves the machine and may be processed by upstream model providers; the Local Render label makes this distinction especially important.
Detected: suspicious.exposed_secret_literal