ClawHub
Back to skill

Security audit

video-skills

Security checks for vulnerabilities and agentic risk

Overview

The skill’s online searches and selected-tool installation fit its media workflow, with privacy and third-party installation considerations.

Search wording goes to varg.ai, so omit confidential information and private links. Review any recommended skill and its installation command before running it. Subsequent generation can require account authorization and credits. The clean static scan does not certify remotely selected components.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

The search workflow sends the user's request to a third-party service without a privacy warning.

Medium
Category
Output Handling
Confidence
97% confidence
Finding

The workflow explicitly sends the person's own request to an external service without a privacy notice or a sensitive-data minimization step. Requests may contain confidential campaign plans, personal information, or private asset links, and placing them in a URL query can expose them to service and intermediary access logs. External search is central to the skill's purpose, which supports benign functionality but does not eliminate the disclosure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
## 2. Read the how-to page it names

`https://varg.ai/how-to/<task-slug>.md` (for example `make-a-ugc-ad-video.md`) has the best skill ("Start here"), alternatives, add-ons (captions, voice, music), the questions to ask with example links, the steps, and how the generation runs on varg. Every catalog page has a `.md` twin; the full index is `https://varg.ai/how-to/llms.txt`. For the same search as a tool, add the public MCP server `https://api.varg.ai/v2/skills/mcp` (no key), or use the `how-to-make-ai-video` skill.

## 3. Let the person choose before spending anything

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The finding is mislabeled as MCP versioning, but the command does invoke an unpinned npm executable and install skills from an unpinned repository. A compromised package release or repository update could introduce code or agent instructions with the agent's available privileges; the instruction to use installation commands supplied by a remote page further weakens the trust boundary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.