video-skills
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches content from an external API to guide agent behavior, including recommended questions for the user and specific installation commands. This creates a surface where remote content can influence agent execution.
- Ingestion points:
SKILL.mdinstructs the agent to searchhttps://varg.ai/how-to/api/searchand read markdown files fromhttps://varg.ai/how-to/to determine the best skills to use. - Boundary markers: No specific boundary markers or isolation instructions are provided for the content retrieved via
curl. - Capability inventory: The skill uses
Bash(curl)for network access and directs the agent to execute further commands (e.g.,npx skills add) based on retrieved data. - Sanitization: The instructions do not specify any validation or filtering of the remote content before the agent processes it.
- [COMMAND_EXECUTION]: The skill uses
curlvia Bash to perform dynamic searches against an external API. - [EXTERNAL_DOWNLOADS]: Fetches search results and tutorial documentation from the vendor's official website (
varg.ai) to provide runtime instructions to the agent.
Audit Metadata