ClawHub
Back to skill

Security audit

varg-music-video

Security checks for vulnerabilities and agentic risk

Overview

The skill was marked suspicious because scanners report missing privacy disclosures around sending user media to external services, plus an unpinned install command; no clear malicious intent was reported.

Before installing, consider whether you are comfortable with the workflow sending audio or reference media to external services and potentially exposing a review page through a hosted link. The scan also flags an unpinned installer. Skillspector inspected all three listed components, but analysis was partial because several local references could not be resolved, so the evidence is incomplete.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

The music-video workflow does not warn that user-provided media may be sent to external services.

Medium
Category
Output Handling
Confidence
87% confidence
Finding

The skill describes processing the user's song and character references through a varg-based generation and lip-sync workflow, with examples using local audio files. Although the README names the services used, it does not explicitly disclose that supplied audio or reference media may leave the user's machine for third-party processing.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command can download and execute an unpinned npm package, so a compromised future release could run with the user's privileges. This is a supply-chain risk in the installer, although the finding incorrectly describes the skills CLI as an MCP server.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
It is written as a **capability pipeline**. Each step names the capability it needs and the tool that provides it: a varg model or tool where one exists, otherwise an outside tool marked **Outside varg**. **Do not drop a step because varg lacks a tool for it.** Use the outside tool, tell the user what it needs, or stop at that gate.

Generation (images, video, voice, music, lip-sync, transcription, ffmpeg) runs on varg: the varg MCP server (`https://mcp.varg.ai/mcp`) or the `varg-ai` skill (REST at `https://api.varg.ai/v2`). Read `varg-ai` for sign-in and model details.

The agent is the crew; the user is the director. Every phase ends at a gate where the user looks at something and says yes before more credits are spent.

The workflow uploads user audio to cloud services without a privacy warning.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The operational workflow explicitly directs uploading the vocal stem for cloud transcription without first establishing permission to disclose that audio. Unreleased music and identifiable vocals may be sensitive, and the production approval gates address quality and spending rather than data handling.

Content

No source excerpt is available for this finding.

Publishing the review page through a tunnel or hosted link lacks an exposure warning.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The skill directs the agent to expose a review application through a tunnel or hosted link without requiring authentication or limiting what is served. An implementation following this guidance could expose unreleased media and director notes, and potentially allow unauthorized comments to enter the agent's revision workflow.

Content

No source excerpt is available for this finding.

The workflow instructs submission of reference media to a generation service without a privacy disclosure.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The case study gives actionable guidance to send reference images and frames to a generation service without a data-disclosure approval step. Although this is expected functionality rather than covert exfiltration, applying the instructions to private likenesses or confidential reference material could disclose assets beyond the user's intended audience.

Content

No source excerpt is available for this finding.