ClawHub
Back to skill

Security audit

varg-unboxing-video

Security checks for vulnerabilities and agentic risk

Overview

The skill is rated benign with medium confidence: the scans found no AIG issues, while the partial Skillspector scan flagged external image processing, an unpinned installer, and one unresolved local reference.

Before installing, consider whether you are comfortable sending product images and prompts to Varg for processing, especially if they are confidential, and whether to use a reviewed, pinned installer version. The verdict is benign, not risk-free; Skillspector's analysis was partial because it could not resolve a local reference.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

The README does not warn that supplied product and packaging photos are sent to third-party services for processing.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The skill uses the user's box and product photos as references for video generation, and the invocation example on L29 explicitly supplies local image paths. Although the README names varg and the generation services, it does not explicitly disclose that these images leave the user's system, which matters for confidential or unreleased product imagery.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The installation example invokes an unpinned npm package through npx, allowing newly published package code to execute with the installing user's privileges. This creates a supply-chain exposure if the package or its publication process is compromised, although the finding incorrectly describes this installer as an MCP server.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
openclaw:
    requires:
      anyBins:
        - curl
    homepage: https://varg.ai/how-to
compatibility: >-
  Needs a VARG_API_KEY with curl (see the varg-ai skill) or the varg MCP connection

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
Two photos in (the closed packaging and the product), a 10-second hands-only unboxing out: taps on the lid, the lid lifting off, the product in its tray, lifted out and switched on, with native ASMR sound and no music. In Motion's 2026 benchmark of 578,750 Meta ads, unboxing had the highest hit rate of any format (9.8%, spend-use ratio 1.3), yet only 2.1% of creatives use it ([runneth/Motion](https://runneth.com/library/research/creative-benchmarks-2026/top-visual-formats)).

Generation runs on varg: REST `https://api.varg.ai/v2` (the `varg-ai` skill) or the MCP server `https://mcp.varg.ai/mcp` (`call_tool`, `get_job`, `estimate_cost`). Price every clip first with `POST /v2/estimate` or `estimate_cost`.

## 1. Ask, then go

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

text

```bash
curl -s -X POST https://api.varg.ai/v2/video -H "Authorization: Bearer $VARG_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"seedance_2_5","prompt":"<the prompt above>","files":[{"url":"BOX_URL"},{"url":"PRODUCT_URL"}],
       "aspect_ratio":"9:16","resolution":"720p","duration":10,"audio":true}'

The workflow sends product photos and prompts to an external generation service without a privacy warning.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The generation request submits the user's box and product image URLs, along with the prompt, to Varg for processing. Although the skill identifies Varg as the generation provider, it does not warn that supplied images and prompts are shared externally, which matters for confidential or unreleased product assets.

Content

No source excerpt is available for this finding.