[SecurityQQ]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot. (Not run in Copilot yet. The skill only calls public endpoints with curl; its search call was checked against the live endpoint.)
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds the how-to-make-ai-video skill (skills/how-to-make-ai-video/SKILL.md, copied as-is from https://github.com/vargHQ/skills/tree/main/how-to-make-ai-video, MIT, author vargHQ).

It lets the agent search varg how to (https://varg.ai/how-to), an index of 2,000+ checked AI video skills and step-by-step tutorials. For a request such as "make a UGC ad for my serum" or "add captions to this video", one curl call returns the best skill for the task with its install command, the 2-4 options to show the person (with example videos) and the steps. Search is free and needs no API key; the skill tells the agent to let the person choose before anything is generated.

Install outside this repo: npx skills add vargHQ/skills --skill how-to-make-ai-video

npm run skill:validate and npm start pass; codespell is clean.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Affiliation: I'm with varg, the team that maintains the skill and the varg how to index. Search is free and keyless. Generating media afterwards runs on varg's paid API (or any other tool the person prefers); the skill states that in its compatibility field.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

🤖 Generated with Claude Code

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:medium — New or substantially changed resource without privileged execution
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access.

Why this tier

• Adds 1 file(s), e.g. skills/how-to-make-ai-video/SKILL.md
• Changes 112 lines (low-risk limit is 40)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Skill validation	✅ Passed	Passed · logs
Skill lint (vally)	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s)
• No staffed reviewer pool owns these files yet; any reviewer with write access counts as the domain reviewer.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 5142751 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	3
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	skills/how-to-make-ai-video/SKILL.md	55	Use the install command from the page for the agent you are running in. Generation (images, video, voice, music, lip-sync, captions, render) runs on varg with one account: the `var
🟠	package-exec-command	skills/how-to-make-ai-video/SKILL.md	82	- The full flow, with the one card format every listing uses: install the `varg-publish-skill` skill (`npx skills add vargHQ/skills --skill varg-publish-skill`).
🟠	package-exec-command	skills/how-to-make-ai-video/SKILL.md	89	-d '{"name":"Lyric Video Maker","summary":"Turn a song into a karaoke-style lyric video for Reels.","source_url":"https://github.com/<you>/<repo>","install":"npx skills add <you>/<

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ how-to-make-ai-video (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/how-to-make-ai-video
✅ how-to-make-ai-video (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[SecurityQQ]

/request-review

[github-actions]

🙋 Added needs-reviewer. Reviewer routing is assigning a reviewer now.

[aaronpowell]

I agree that Copilot media-generation workflows can fit this repository, so the topic itself is not the issue. As submitted, though, this skill routes users through Varg’s product catalog/MCP and includes a Varg publishing flow; the LICENSE and upstream README confirm the product provenance and paid platform. I recommend closing this version as a vendor funnel. A vendor-neutral, Copilot-focused workflow would need to be submitted separately.