AI Comic Drama Shot Maker

• Outcome: Review
• Latest audit: Aug 21, 2026 · 7:28 AM UTC
• Version: 0.1.5

Overview

This skill does comic-shot generation, but it also asks users to trust a broad shared Beatra credential and silent self-updating code that can replace local package files.

Review this package before installing if you are uncomfortable with a broad shared Beatra device token, wallet-spend-capable account access, telemetry/source attribution, or package files updating automatically. If installed, disable automatic updates with the documented --auto off command and revoke the Beatra device authorization from the console when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while instructing use of a Python helper that can access files, shell, network, environment, and write state locally. This hidden capability materially expands the trust boundary and prevents users or host systems from making informed consent and sandboxing decisions, especially because it can upload local files and persist credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior goes far beyond comic-shot generation: it includes browser-based auth, persistent credential storage, arbitrary remote tool invocation through an MCP client, telemetry/registration, local file upload, uninstall cleanup, and self-update. That mismatch can mislead users into granting broad access under a narrow creative pretext, increasing the chance of credential exposure, unintended data transfer, and execution of unrelated remote operations.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill embeds self-updating package behavior unrelated to its primary purpose, creating a supply-chain and code-integrity risk during normal operation. Even with stated verification, automatic replacement of local package files means the skill can change its executable behavior over time without a fresh security review by the user or host platform.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The authorization scope bundle is far broader than the skill’s stated purpose of generating comic-drama shots. In addition to image/video generation, it requests wallet spending, task control, artifact read/write, music generation, speech generation, and voice read/write permissions, which creates unnecessary account exposure if the skill or its stored token is abused or compromised.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The authorization flow actively provisions and persists an access token carrying broad account capabilities that are not justified by the package description. Because the token is then stored for reuse as a shared credential, any downstream misuse of the skill, local compromise, or logic flaw could exercise unrelated privileged actions such as wallet spending or broader task/artifact operations.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The client contains a full self-update mechanism that downloads manifests and archives, validates them, and then replaces local package files on disk. Even with multiple integrity checks, this materially expands the skill's capabilities beyond comic-shot generation into software lifecycle management and self-modification, increasing the blast radius of any upstream compromise, signing/distribution failure, or logic bug in update handling.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill records local inventory data and sends installation telemetry unrelated to the stated comic-drama generation purpose, including install path, platform, timestamps, and external installation references. This creates unnecessary privacy and behavioral-tracking exposure, and in an agent context it can help map the local environment or correlate installations without clear user need.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code fingerprints the host agent environment by inspecting environment variables and local host metadata to classify the running platform. For a comic-shot creation skill, this is not obviously necessary and can be used to tailor behavior by host, evade scrutiny, or increase user/environment profiling beyond functional need.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Installing newer releases without separate confirmation during ordinary use undermines meaningful user consent and can silently change code that has file, network, and credential access. In this skill's context, that is more dangerous because routine creative actions can trigger package replacement before the user understands the operational and security implications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document states that the client silently checks for and automatically installs newer releases by default before ordinary commands, without separate confirmation. Even though the text describes integrity checks and rollback protections, silent self-update that replaces local files expands the attack surface and reduces user control, especially if the update channel, signing, or distribution path is ever compromised.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: Exposing self-update and package replacement behavior is a form of self-modification that is risky in an agent skill, especially one whose advertised purpose is media generation. This broadens the trust boundary from a static skill to a codebase that can rewrite itself, making upstream service compromise or update-channel mistakes far more dangerous.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.