ClawHub
Back to skill

Security audit

varg-product-lock

Security checks for vulnerabilities and agentic risk

Overview

The scanners report a product-media workflow that sends clips and descriptions to Varg for analysis, with privacy and unpinned-installer cautions; the verdict is benign because the flagged behavior appears aligned with the skill’s purpose, though the overall confidence is medium.

Before installing, consider whether you are comfortable sending product clips and descriptions to Varg, especially if they contain confidential material. The README reportedly lacks a clear privacy warning, and the installer is unpinned. The review is medium confidence and incomplete because one local reference could not be resolved, so benign does not mean risk-free.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

The skill does not warn that user-provided product photos and clips are sent to external AI services.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The README identifies external AI providers but does not explicitly explain that supplied photos and clips will be disclosed to those services or caution against submitting confidential material. Product media can contain unreleased designs or other sensitive information, making this a privacy-consent gap rather than evidence of covert exfiltration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The installation command invokes an unpinned npm package through npx, allowing the code executed during installation to change without changes to this README. This creates a supply-chain exposure if a future package release is compromised; however, the finding incorrectly describes this installer as an MCP server.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
AI video models redraw the product in every frame. With one photo they guess the hidden sides, and long, soft or printed products drift: wedges turn into blocks, labels melt, cans invent a back. This skill locks the product before any clip is generated and checks every clip after.

Generation runs on varg: REST `https://api.varg.ai/v2` (the `varg-ai` skill) or the MCP server `https://mcp.varg.ai/mcp`.

## 1. Write the lock sheet (one per product)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

4. Check every clip, rerun only what fails

bash
curl -s -X POST https://api.varg.ai/v2/tools/video_analyze/call -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" -d '{"model":"video-analyze","video_url":"CLIP_URL",
  "prompt":"Compare the product in this clip with this description: <lock sheet>. For the first, middle and last second: does shape, size, color, label and every fixed detail match? Answer PASS or FAIL per attribute with the second where it breaks."}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

4. Check every clip, rerun only what fails

bash
curl -s -X POST https://api.varg.ai/v2/tools/video_analyze/call -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" -d '{"model":"video-analyze","video_url":"CLIP_URL",
  "prompt":"Compare the product in this clip with this description: <lock sheet>. For the first, middle and last second: does shape, size, color, label and every fixed detail match? Answer PASS or FAIL per attribute with the second where it breaks."}'

The workflow sends product media and descriptions to an external service without a privacy warning.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The analysis request sends a clip URL and product description to varg, enabling external access to the referenced media. Although external processing is disclosed generally, the workflow lacks a sensitive-data warning or authorization checkpoint before potentially confidential product assets are shared.

Content

No source excerpt is available for this finding.