varg-ad-variants
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands using node, ffmpeg, and ffprobe. The included hook-swap.mjs script performs video concatenation and audio overlay by spawning subprocesses with structured argument arrays, avoiding unsafe shell interpolation.
- [EXTERNAL_DOWNLOADS]: Communicates with varg.ai, mcp.varg.ai, and s3.varg.ai to perform AI-driven video analysis and to retrieve generated creative assets. These operations are consistent with the skill's purpose within the author's ecosystem.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied ad creatives and instructions as input for generating variants. Ingestion points: Video files and metadata processed in SKILL.md and API responses. Boundary markers: Not explicitly defined. Capability inventory: File system access (Read/Write/Edit), network operations (curl), and command execution (node/ffmpeg). Sanitization: Not observed in the provided script logic.
- [CREDENTIALS_UNSAFE]: Specifies a requirement for a VARG_API_KEY. It follows best practices by directing users to manage this credential through the platform's environment configuration or the varg-ai skill.
Audit Metadata