Security audit

varg-mascot-jingle-ad

Security checks for vulnerabilities and agentic risk

Overview

The scanners rate this skill benign with medium confidence: its reported ad-generation workflow appears purpose-aligned, with privacy disclosure and unpinned installation concerns to consider.

Before installing, consider whether you are comfortable sending product photos, brand details, prompts, and audio to external generation services. Use only material you are authorized to share, and consider that the installer version is not pinned. The scan inspected both reported components, but overall analysis was partial because a local path-like reference could not be resolved.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

The README does not warn that user-provided product photos and brand content are sent to external services.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The skill transforms user-provided product photos into ads using varg and external generation models, including an example that starts with a local image file. Although the README names the API and models, it does not explicitly disclose that the supplied assets leave the user's system for processing, which matters for confidential or unreleased product material.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The installation command executes the unpinned npm package skills, allowing the code executed during installation to change between runs. A compromised future release could execute with the installer's permissions; this is a supply-chain exposure, although the finding incorrectly describes the installer as an MCP server.
Content: No source excerpt is available for this finding.

The workflow sends user-provided product imagery and audio to external AI services without a privacy warning.

Medium

Category: Output Handling
Confidence: 91% confidence
Finding: The workflow instructs the agent to use the product photo with nano_banana_2_1 and then supply the mascot image and master song to Seedance. Although the services are named, the skill does not warn that these assets will leave the user's environment or advise against submitting confidential or unreleased product material.
Content: No source excerpt is available for this finding.