ai-audiobook-narration

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:04 AM UTC
• Version: 0.2.0

Overview

The skill is a real audiobook workflow, but it also grants broad Beatra account access and silently updates its own installed code by default.

Review this carefully before installing. It is not just a local narration helper: it connects to Beatra, stores a shared device token, can spend credits after approval, sends installation/platform metadata, and silently updates its own package unless automatic updates are disabled with `python3 scripts/mcp_client.py update --auto off`.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares itself as an audiobook narration workflow, but the documentation clearly instructs use of shell execution, network access, local file reads/writes, and environment/state handling via a bundled Python client. That mismatch means the skill can perform sensitive operations without declared permissions, reducing transparency and increasing the chance of users or hosting systems granting broader access than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior goes well beyond audiobook generation into OAuth login, credential storage, generic authenticated tool invocation, arbitrary file upload, telemetry, uninstall logic, and software update/install behavior. This is dangerous because users invoking a content-production skill would not reasonably expect account management, package lifecycle changes, or broad remote operations, creating a strong trust and scope gap.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill includes self-updating package installation behavior that is unrelated to the core task of producing audiobook narration. Even with integrity-check language, self-update logic introduces supply-chain and code-change risk because future code can be fetched and installed during normal use.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatic software update and local file replacement are not necessary to narrate text and expand the skill's authority beyond its stated business purpose. That extra authority increases the blast radius if the update channel, package, or embedded client is compromised or misused.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The documentation states that a bundled client silently checks for and automatically installs updates before normal commands, which introduces network activity and code changes unrelated to the audiobook narration skill’s stated purpose. Even with verification controls described, silent self-updating expands the trust boundary, can surprise users, and creates a software supply chain risk if the update channel or signing/checking logic is ever compromised.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This file documents the ability to replace installed package files, including the client itself, which is a powerful persistence and code-modification capability not justified by audiobook generation features. Any mechanism that can rewrite local package contents can be abused to deliver unauthorized behavior, and the mismatch with the advertised skill purpose makes the capability especially suspicious.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation describes automatic external registration telemetry that is not necessary for the stated audiobook narration function. Even if labeled non-billable and best-effort, it still sends package and environment-linked installation data off-host, creating undisclosed metadata collection and expanding privacy and supply-chain risk.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file documents resolving the real agent environment from environment signatures or a host file and attaching that platform value to registration. This is effectively host-environment fingerprinting unrelated to audiobook generation, increasing privacy exposure and enabling environment tracking across installs or sessions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope set is far broader than the stated audiobook narration purpose, including unrelated capabilities across media generation, artifact/task management, and wallet spending. Over-scoped credentials violate least privilege and materially increase blast radius if the skill, token store, or upstream service is abused or compromised.

Context-Inappropriate Capability

Critical

• Confidence: 95% confidence
• Finding: Artifact writing and task cancellation may be legitimate in some workflows, but they are not clearly justified by the visible audiobook narration description and are bundled without constraint. Unnecessary modification and cancellation capabilities can disrupt user work or enable destructive actions if the credential is abused.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Artifact writing and task cancellation may be legitimate in some workflows, but they are not clearly justified by the visible audiobook narration description and are bundled without constraint. Unnecessary modification and cancellation capabilities can disrupt user work or enable destructive actions if the credential is abused.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Artifact writing and task cancellation may be legitimate in some workflows, but they are not clearly justified by the visible audiobook narration description and are bundled without constraint. Unnecessary modification and cancellation capabilities can disrupt user work or enable destructive actions if the credential is abused.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The client contains extensive self-update and installation-management logic unrelated to audiobook narration, giving the skill the ability to download, validate, and replace its own package files. Even with several safety checks, this substantially expands the attack surface and creates a persistence/self-modification capability that is unnecessary for the stated function of the skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill records local inventory and sends installation telemetry, including package version, install path reference, and platform data, despite this behavior not being necessary for audiobook narration. Undisclosed inventorying and outbound telemetry increase privacy risk and create side-channel visibility into the user's environment.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code fingerprints the host agent environment via environment variables and host.json to derive a platform label, then reuses that in requests and telemetry. This is not required for audiobook narration and increases privacy and tracking risk by identifying the execution context across calls.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The uninstall script explicitly manages a shared Beatra device connection and makes decisions about preserving or revoking credentials for all installed skills, which is outside the narrowly stated audiobook narration purpose of this package. Even if framed as cleanup logic, bundling platform-wide credential lifecycle control into a content-generation skill increases trust and blast radius: uninstalling this skill can affect authentication state relied on by unrelated skills.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code reads a bearer token from shared state and performs a POST to the platform revocation endpoint, giving the skill authority to invalidate a device authorization unrelated to audiobook generation. In the context of a third-party skill, account/device token revocation is a sensitive control-plane action that can disrupt other installed skills and should not be embedded in package code.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script deletes multiple files in ~/.beatra, including credentials, installation, host, skills, and registrations state, which are described as shared across skills. Although it tries to do so only when no survivors are found, this still gives a single skill the ability to erase shared platform state, causing denial of service or forced reauthentication for unrelated functionality if the logic is wrong, stale, or abused.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill says automatic updates are enabled by default and can install newer packages without separate confirmation, but this behavior is not clearly disclosed in the top-level description. Silent default updates materially change the trust model because users may execute remote-updated code they never explicitly reviewed or approved.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown describes silent automatic update checks and installs without an up-front warning about system-impacting behavior such as network calls and local file replacement. Lack of clear user warning undermines informed consent and can conceal behavior that materially affects system state, which is particularly concerning in a content-production skill where users would not expect updater functionality.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The markdown describes automatic network registration and writing a local cache file without an explicit user-facing warning or consent mechanism. Hidden telemetry and filesystem modification reduce user control, can violate operator expectations in sensitive environments, and make the package riskier in contexts where creative tools are expected to be local-only.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Automatic silent self-update can modify installed package files during ordinary command execution without a clear user-facing prompt at that time. In a skill context, silent code replacement is especially risky because users expect a content-production tool, not a component that may rewrite itself in the background.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The registration flow transmits installation reference, package version, and platform details as best-effort telemetry without an in-band warning or consent step. Hidden telemetry is risky in a creative-writing/audio skill because it is unrelated to the expected task and can expose environment metadata to a remote service.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 92% confidence
• Finding: Referencing credentials.json as part of the state the skill may delete indicates direct interaction with shared authentication material. In this skill context, access to credential-bearing files is more dangerous because audiobook narration does not require credential handling, so the presence of this capability is unjustified and expands the attack surface around secrets.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 99% confidence
• Finding: The _device_token function reads the shared access token from credentials.json so the skill can use it in a revocation request. Direct token access by an audiobook skill is a significant privilege escalation relative to its stated purpose: any code that can read bearer tokens can potentially misuse them for unauthorized API actions, exfiltration, or account disruption.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.