Back to skill

Security audit

AI Image Generation Studio

Security checks across malware telemetry and agentic risk

Overview

The skill is a real image-generation integration, but it asks for broad account powers and silently self-updates installed files, so users should review it carefully before installing.

Install only if you are comfortable granting Beatra a shared device credential with permissions beyond image generation and allowing this package to update itself automatically. Consider disabling automatic updates with the documented --auto off command, and review Beatra account authorization and billing controls before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares no permissions while instructing use of local file access, shell execution, network calls, environment/credential handling, and file modification via an updater. That mismatch prevents informed consent and weakens sandboxing or policy enforcement, making the skill more dangerous because it also handles uploads, credentialed remote operations, and local package changes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The advertised purpose is image generation, but the skill also performs credential acquisition/storage, arbitrary MCP tool invocation, local file upload, telemetry/registration, uninstall management, and package self-update. This broad hidden behavior materially expands the trust boundary and attack surface; in this context, undeclared auth, remote invocation, and self-modifying code are especially risky because users may invoke the skill expecting only creative image processing.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The documentation describes a bundled client that performs self-updating behavior unrelated to the skill’s declared image-generation purpose. Even though the text claims verification and rollback protections, shipping a silent updater expands the trust boundary and introduces code-changing behavior that is unnecessary for normal image creation, making the skill materially riskier if the update path or signing assumptions fail.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The client silently checks for and installs newer releases before ordinary commands, without separate confirmation. A hidden auto-install path is dangerous because it allows package code to change during routine use, creating a supply-chain execution surface that can be abused by a compromised update source or implementation flaw, especially since this behavior is not justified by the image-editing function.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The documentation states that one approval covers image, video, music, speech, upload, model, and task tools, which materially exceeds the stated purpose of an image-generation skill. This creates unnecessary privilege scope and increases the blast radius if the skill, token, or remote endpoint is misused or compromised.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The bundled MCP client is documented as a generic remote tool discovery and invocation mechanism using tools/list and tools/call, not a narrowly scoped image-only interface. In the context of an image-generation skill, this enables capability expansion and arbitrary access to remote actions beyond user expectations, violating least privilege.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
Granting access to unrelated media capabilities such as video, music, and speech broadens the token's privileges far beyond the declared image-generation use case. If abused, the credential could be used to invoke non-image services, causing data exposure, unexpected billing, or unauthorized content operations across other modalities.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The OAuth scope set is materially broader than the skill's stated purpose of AI image generation and editing. It requests permissions for videos, music, speech, voice management, task control, artifact access, and wallet spending, which violates least privilege and would let a compromised or misused skill act far outside the expected user intent.

Context-Inappropriate Capability

Critical
Confidence
99% confidence
Finding
The skill asks for non-image capabilities including video, music, speech generation, and voice read/write permissions, none of which align with the declared image-studio functionality. This expands the blast radius of any token misuse and creates an opportunity for unauthorized content generation or voice-related abuse under the user's account.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill asks for non-image capabilities including video, music, speech generation, and voice read/write permissions, none of which align with the declared image-studio functionality. This expands the blast radius of any token misuse and creates an opportunity for unauthorized content generation or voice-related abuse under the user's account.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The client includes substantial self-update and installation telemetry logic unrelated to the advertised image-generation purpose. Even though some validation is present, bundling code that can modify the installed package and report installation metadata expands the attack surface well beyond expected functionality and creates an unexpected remote-control channel for code and metadata flow.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code detects the host agent environment from environment variables and local state, then injects source_platform and package identifiers into tool calls and registration events. This fingerprints the execution environment and transmits metadata not necessary for basic image generation, increasing privacy risk and enabling service-side profiling of users and agent platforms.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The uninstall script manages and conditionally revokes a shared device authorization stored under ~/.beatra, which is functionality outside the stated image-generation purpose of the skill. Even if framed as cleanup logic, touching shared credentials broadens the skill's authority and creates a cross-skill impact surface: uninstalling this package can affect other installed skills and the user's device-level authorization state.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
This code performs a remote POST to revoke an OAuth device token during uninstall, which is not necessary for core image-generation functionality and introduces security-sensitive network side effects. Because the token is shared across skills, a mistaken or manipulated revocation can deny service to unrelated skills and alter the user's account/device authorization without clear separation of responsibilities.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states that newer releases install automatically during ordinary commands without separate confirmation, meaning local code may change as a side effect of routine use. Even with integrity checks, silent self-update increases supply-chain and change-control risk, and it is more dangerous here because the tool also has shell, network, file-write, and credential-related capabilities.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation states that the updater is silent and enabled by default, yet this behavior is not surfaced as an upfront warning in the skill’s description. Modifying installed files without clear prior notice undermines user consent and increases the chance that code changes occur unexpectedly during normal operation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The document states that the client automatically performs an installation registration call and writes to a local cache file, but it does not explicitly warn users about the telemetry and filesystem side effects before first use. Even though the data is described as non-billable and non-secret, silent outbound registration and local persistence can undermine user expectations, create privacy/compliance issues, and be problematic in restricted or sensitive environments.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
maybe_auto_update() performs silent background update checks and can replace installation files during ordinary command execution without an execution-time prompt. In a skill context, silent self-modification is especially risky because users expect a narrowly scoped tool, not code that can alter itself opportunistically based on remote content.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
register_installation() sends package slug, version, platform, and an external installation reference to the remote service as best-effort telemetry, and this occurs without any user-facing disclosure in the request path. For an image-generation skill, undisclosed telemetry is a trust and privacy problem because it transmits device-installation metadata beyond what is needed to fulfill the user's immediate task.

Credential Access

High
Category
Privilege Escalation
Content
def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):
Confidence
89% confidence
Finding
The function reads an access token from ~/.beatra/credentials.json and uses it to call a remote revocation endpoint. Although the apparent goal is cleanup rather than theft, this is still direct handling of a shared bearer credential, and any compromise, misuse, or unexpected invocation of this script affects device-wide authorization beyond this single skill.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
96% confidence
Finding
The skill exposes a self-update capability that can download and replace its own package files. Although the implementation includes integrity and path-safety checks, self-modifying behavior remains dangerous in this context because it enables post-installation code changes from a remote service, which exceeds the expected behavior of an image-generation skill and materially increases supply-chain and trust risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.