ClawHub
Back to skill

Security audit

varg-birthday-video

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently creates birthday videos using Varg’s online services and a local assembly script, with privacy and usage-cost considerations.

Use photos and personal details you are authorized to share with Varg and its model providers. Check their retention and sharing terms, especially for family photographs; private delivery does not mean local-only processing. Confirm generation costs and choose an output filename that can safely be overwritten. Linked skills and live service behavior were not evaluated.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
# key still
curl -s -X POST https://api.varg.ai/v2/image -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"gpt_image_2_5","aspect_ratio":"9:16","prompt":"<still prompt>","files":[{"url":"FACE_PHOTO_URL"}]}'
# animate it
curl -s -X POST https://api.varg.ai/v2/video -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
# key still
curl -s -X POST https://api.varg.ai/v2/image -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"gpt_image_2_5","aspect_ratio":"9:16","prompt":"<still prompt>","files":[{"url":"FACE_PHOTO_URL"}]}'
# animate it
curl -s -X POST https://api.varg.ai/v2/video -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
the hook, their face (or their dog's), the details only their people know. Generic "Happy Birthday" templates
are what everyone already gets; the reason to make one with an agent is that it can be about one person.

Generation runs on varg: REST `https://api.varg.ai/v2` (the `varg-ai` skill) or the MCP server
`https://mcp.varg.ai/mcp` (`generate_image`, `generate_video`, `generate_music`, `call_tool`, `get_job`,
`estimate_cost`). Quote the price of every clip before it runs.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

animate it

curl -s -X POST https://api.varg.ai/v2/video -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json"
-d '{"model":"wan_3","duration":10,"aspect_ratio":"9:16","files":[{"url":"STILL_URL"}],"prompt":""}'

poll: GET https://api.varg.ai/v2/jobs/ until status is completed, then output.outputs[0].url

text

## 4. Join, lay the song, export

The workflow sends personal photos and identifying prompts to an external generation service without a user-facing privacy warning.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The workflow identifies varg as the generation platform, but does not explicitly obtain informed approval to send identifiable photographs and personal details for external processing. Consent to animate a face, particularly consent inferred by a surprise-gift sender, does not necessarily cover disclosure to the service or its model providers.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
# key still
curl -s -X POST https://api.varg.ai/v2/image -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"gpt_image_2_5","aspect_ratio":"9:16","prompt":"<still prompt>","files":[{"url":"FACE_PHOTO_URL"}]}'
# animate it
curl -s -X POST https://api.varg.ai/v2/video -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
# key still
curl -s -X POST https://api.varg.ai/v2/image -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"gpt_image_2_5","aspect_ratio":"9:16","prompt":"<still prompt>","files":[{"url":"FACE_PHOTO_URL"}]}'
# animate it
curl -s -X POST https://api.varg.ai/v2/video -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

curl -s -X POST https://api.varg.ai/v2/image -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json"
-d '{"model":"gpt_image_2_5","aspect_ratio":"9:16","prompt":"","files":[{"url":"FACE_PHOTO_URL"}]}'

animate it

curl -s -X POST https://api.varg.ai/v2/video -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json"
-d '{"model":"wan_3","duration":10,"aspect_ratio":"9:16","files":[{"url":"STILL_URL"}],"prompt":""}'

poll: GET https://api.varg.ai/v2/jobs/ until status is completed, then output.outputs[0].url

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/song.md (reported line 55)May include surrounding context.

cutting around it.

bash
curl -s -X POST https://api.varg.ai/v2/transcription -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"whisper_large_v3","audio_url":"SONG_URL"}'

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/formats.md (reported line 52)May include surrounding context.

{ERA_YEAR} in {CITY}, filmed by a friend. It must read as a real home tape, not a filter. References: @image1 = {NAME}'s face, hair and outfit only. Gen 1 (0-15 s): getting ready at the mirror, meeting {FRIENDS} on the street, buying the cake (the box carries through every scene). Gen 2 (15-30 s): the candles in a dim room, flash photos, the walk home at night. Look: 4:3 framing inside 16:9, auto-exposure pumping, soft focus, tape date stamp {DATE} in the corner, on-camera mic. Era objects only: flip phones, a point-and-shoot, no smartphones, no modern logos.

text

The workflow directs the agent to submit personal photos to image and video generation services without disclosing third-party processing.

Medium
Category
Output Handling
Confidence
92% confidence
Finding

The montage instructions use real family photographs, including childhood images, as inputs to hosted generation models without a processing disclosure or approval step. Private delivery of the final video does not prevent the input photographs from being disclosed to external processors.

Content

No source excerpt is available for this finding.

The reference provides anniversary, wedding, and holiday video workflows explicitly excluded by the manifest.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The manifest explicitly excludes weddings, anniversaries, and holiday greetings, directing those requests to varg-occasion-video. This section instead supplies a couple's love-story workflow referencing a wedding surprise and instructs using birthday formats for Mother's Day, Father's Day, and Valentine's Day, expanding the skill's operational guidance beyond its stated scope.

Content

No source excerpt is available for this finding.

The workflow sends personal details to an external music-generation service without a privacy warning.

Medium
Category
Output Handling
Confidence
97% confidence
Finding

The workflow sends lyrics containing names, ages, and potentially identifying life details to a hosted music-generation service without an explicit privacy approval step. Although external generation is part of the stated purpose, users may not expect personal anecdotes about another person to be shared with downstream processors.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/song.md (reported line 42)May include surrounding context.

re-try with the name spelled phonetically if its checker refuses it.

bash
curl -s -X POST https://api.varg.ai/v2/music -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"eleven_music_v2_5","duration":32,"prompt":"<the prompt above>"}'
# MCP: generate_music { prompt, duration: 32 }  (eleven_music_v2_5 is the default)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/song.md (reported line 42)May include surrounding context.

re-try with the name spelled phonetically if its checker refuses it.

bash
curl -s -X POST https://api.varg.ai/v2/music -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"eleven_music_v2_5","duration":32,"prompt":"<the prompt above>"}'
# MCP: generate_music { prompt, duration: 32 }  (eleven_music_v2_5 is the default)

Static analysis

No suspicious patterns detected.