Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this video-prompting skill suspicious because scanners report guidance that may bypass content moderation, instructions to upload local media without clear privacy safeguards, and an unpinned installer; scan coverage is partial.
Treat this as a review item rather than a confirmed malicious skill. Before installing, consider whether you are comfortable with its moderation-rephrasing advice and its hosted-media upload workflow; avoid sharing sensitive footage or recordings unless you have checked the destination and approved the disclosure. The scan was partial because some referenced paths were unresolved, so the evidence does not cover every possible referenced resource.
The installation command executes an unpinned npm package and retrieves skill content from a mutable repository reference. A compromised or unexpectedly changed release could execute code or install altered agent instructions, although the finding incorrectly describes this installer as an MCP server.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
homepage: https://varg.ai
compatibility: >-
Needs the varg MCP connection (https://mcp.varg.ai/mcp, OAuth sign-in) or a VARG_API_KEY for
https://api.varg.ai/v2 (see the varg-ai skill). QA uses ffmpeg and ffprobe locally when
available; otherwise the MCP analyze_video tool and the hosted ffmpeg tool.
allowed-tools: Bash(curl:*) Bash(ffmpeg:*) Bash(ffprobe:*) Bash(jq:*) Read Write Edit
---
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
g than an
image-plus-audio talking-head model; do the body in Seedance, then lip-sync on top.
- **Voices**: pick with `search_voices` (by `intent` in words, or `filters`) and audition 2-3 takes yourself or with
the person; choose by ear. If `eleven_v4` answers `voice_not_found` for a name or preset id, pass the raw ElevenLabs
`voice_id`. Audio tags shape delivery: `[breathless whisper] ... [fierce shout] ...`, `[calm, slow, soft-spoken]`,
`[pause]`. Transcribe each take (`whisper_large_v3`) and check brand words are pronounced cleanly.
- Keep one voice per character across the whole project, and freeze the approved take: reuse its file URL instead of
regenerating, because a new take differs in length and breaks every retime and lip-sync built on the old one.
## 8. Music
- **The song is the clock.** Measure the beat grid on the real file and cut on downbeats (`varg-music-video`).
Never trust the BPM you asked for. Same lyrics, same "112 BPM" prompt: ElevenLabs Music measur
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
from an approved front view, to fill a missing sheet view.
- `nano_banana_pro` (legacy): observed that a resolution provider option made the requested aspect ratio be ignored;
after any provider option, check the real output size and ratio.
---
## Voice
### ElevenLabs v4 (`eleven_v4`, `eleven_v4_turbo`)
- Audio tags in square brackets steer delivery: `[whispers]`, `[breathless whisper]`, `[fierce shout]`,
`[calm, slow, soft-spoken]`, `[pause]`, `[laughs]`. ~84 per typical line (Turbo ~42, good for drafts).
- Find voices with `search_voices` (`intent` in words, or `filters` such as gender and accent). Pass the voice's
`voice_id`. Observed: a voice name or `preset_...` id returned `voice_not_found` on `eleven_v4` while the raw
ElevenLabs voice id worked; the varg-ai skill lists ids for the premade voices.
- Take length varies between generations: freeze the approved take and reuse its URL.
## Music
| Model | Use | Observed |
|---|---|---|
| `lyria_3_5` (~11) | songs with v
The guidance recommends rephrasing rejected imagery so that the same moment passes a content filter, without distinguishing false positives from genuinely prohibited content. Although the examples could be permissible dramatic scenes, this teaches a general response that can undermine provider safety controls.
The operational instructions direct an agent to upload local media without requiring approval for external disclosure or checking whether the files are sensitive. Hosted processing is expected for this service, but local references, actor images, or unpublished footage may require different authorization than ordinary generation spending.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Calling varg through the MCP server
The varg MCP server (`https://mcp.varg.ai/mcp`) exposes every varg model on one credit balance. The same request
bodies work on the REST API (`POST https://api.varg.ai/v2/tools/<tool>/call` with a `VARG_API_KEY`; setup in the
`varg-ai` skill). Model specs: `https://varg.ai/models/llms.txt` and `https://varg.ai/models/<model>.md`.
## 1. Connect and sign in
The instructions upload local bytes and return a public_url without an explicit privacy or disclosure approval gate. This can expose confidential footage, personal images, or embedded metadata outside the local environment; the precise accessibility and retention of those URLs are not established here.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X PUT -H "Content-Type: application/octet-stream"
--data-binary @shot.mp4 "https://api.varg.ai${proxy_url}"
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Credits: ~82 per 5 s at 720p, ~123 at 1080p (observed about 25 per second at 1080p). Five parallel 5 s clips took
6-8 minutes; one job once hung for about 30 minutes (submit a backup after ~15, cancel the loser).
- Observed: one file = start frame; two files = start and end frame. Chaining the end of clip N into the start of
clip N+1 gave seamless continuous moves. Clips came back with native ambient audio without asking.
- Observed: the most faithful to the still, including things you did not want in it (a logo). Clean the still first.
- Prompt it like a camera operator: one continuous move, "no cuts", realistic micro-movements, "no talking" when
silent. For multi-shot prompts, elements and the reference route, see the `kling-4-prompting` skill.
This workflow explicitly tells the agent to upload a shot and its vocal slice for processing by Sync via the configured provider. The file does not warn that user-supplied footage and voice recordings will be shared with an external service, which could expose personal or confidential media.
The generic transcription template fixes the language to "en", while the file instructs users to preserve template content outside placeholders. No English-only scope or user opt-in is documented, so this imposes a language constraint on recordings that may use another language.
The description explicitly includes asking "which model" as an activation condition without requiring a video-generation context. This phrase also occurs in unrelated requests about language models, statistical models, or product models, potentially causing unintended invocation.
These invocation conditions can also describe unrelated model selection or character-writing tasks. Although other triggers name specific video models, the broad alternatives have no explicit domain restriction or exclusions.