ai-image-realism

• Outcome: Review
• Latest audit: Aug 20, 2026 · 6:22 AM UTC
• Version: 0.2.6

Overview

The skill does the advertised image retouching, but it also uses broad shared Beatra credentials and silently self-updates code by default, so it should be reviewed before installation.

Install only if you are comfortable connecting a Beatra account, uploading selected images to Beatra, spending credits on confirmed generation calls, keeping a broad shared Device Token under ~/.beatra, and accepting default silent package updates. Consider disabling automatic updates with the documented update --auto off command and revoke the device in the Beatra Console if you later remove access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares itself as an image-retouching workflow, yet it requires broad code capabilities including shell, network, file read/write, and environment access with no explicit permissions declaration. That mismatch increases the chance that users or host systems grant powerful execution rights without understanding the real attack surface, enabling credential access, arbitrary file modification, or remote command execution if the bundled client or update path is abused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior materially exceeds the stated purpose: besides image editing, it performs authentication, persistent credential storage, telemetry/registration, remote tool invocation, local file uploads, uninstall cleanup, and self-updating code replacement. This is dangerous because users may trust the skill under a narrow image-editing mental model while it actually introduces a much broader privileged runtime and supply-chain surface.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill authorizes silent automatic updates of the bundled client and local package file replacement, which creates a software supply-chain risk inside a tool advertised as a focused image retouching skill. Even with integrity checks described, silent code changes bypass meaningful user review and can convert a previously trusted installation into an execution vector if the update channel, signing process, or publisher account is compromised.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Silent package updates and local file replacement are not necessary for the stated business function of improving image realism, so they represent unjustified privileged behavior. If exploited through a compromised update service, CDN, signing pipeline, or logic flaw, this mechanism could deliver arbitrary code or alter local files without user awareness, leading to full host compromise.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The OAuth scope requests far more capability than an AI image realism retouching skill reasonably needs, including wallet spending, voice management, music/video generation, and task/artifact operations. If this shared credential is compromised or the skill later invokes unrelated APIs, the user account could be abused well beyond image editing, violating least-privilege and expanding blast radius.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The authorization flow provisions a shared Beatra credential and records cross-skill inventory state in a common directory, allowing one skill's authorization to become reusable context for other skills. In the context of a narrowly described image retouching skill, this weakens isolation between packages and increases the chance that a compromise or misuse in one skill affects other installed skills using the same account connection.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This client contains substantial package-management behavior—discovery, download, verification, extraction, rollback, locking, and installation-state handling—that is unrelated to the advertised image-realism editing purpose. Even though the update path includes several integrity checks, bundling broad self-management capability into a creative-editing skill increases attack surface and gives the skill authority to modify itself and local state beyond user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill records installation telemetry, platform data, external installation references, and a local skill inventory despite being presented as an image-realism editor. This expands data collection beyond the stated function and creates privacy and trust concerns, especially because registration is performed automatically and best-effort in the background.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code fingerprints the host environment by inspecting environment variables and host.json to identify platforms such as Claude Code or Codex. For an image-retouching skill, this is not obviously necessary and increases privacy sensitivity while enabling environment-aware behavior that could diverge across hosts without user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The uninstall script is designed to revoke a shared Beatra device credential and remove shared state under ~/.beatra, which is functionality far outside the advertised image-retouching purpose of the skill. Even if intended as lifecycle management, this creates account-affecting behavior that can disrupt other installed skills and gives this package access to security-sensitive global state.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This code performs a network POST to the OAuth/device revocation endpoint using a bearer token loaded from local state. For an image-editing skill, embedded account-management network capability is over-privileged and dangerous because compromise or misuse of the script could revoke device access unexpectedly or be repurposed for unauthorized token handling.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script enumerates and deletes shared files including credentials.json, installation.json, host.json, skills.json, and registrations.json under ~/.beatra. Access to and deletion of cross-skill shared state exceeds the declared scope of the skill and can cause denial of service for other skills or unintended loss of account/device configuration.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation states that the client silently checks for and automatically installs updates by default before normal commands, without separate confirmation. Even with integrity checks and fixed update sources, automatic modification of locally installed code changes the trust boundary and can expose users to unintended code changes, supply-chain compromise of the official source, or operational breakage without explicit consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document states that the bundled client automatically performs an installation registration call and writes a local cache file on first use, but it does not present this behavior as telemetry or clearly warn users about the outbound network request and filesystem modification. Even if the data is described as non-secret and non-billable, undisclosed automatic reporting and local persistence can violate user expectations, enterprise policies, or privacy requirements.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The script writes host metadata such as detected platform and device name to disk without clear user-facing disclosure. While not directly leading to code execution or account takeover, it creates unnecessary local persistence of environment details that may reveal agent/runtime context and host identity to other local processes or later components.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script records the installed skill's local path in a shared inventory file without user-facing notice. This exposes local filesystem layout and ties installed packages to a shared credential context, which is unnecessary for a simple image-editing skill and increases privacy leakage on multi-tool systems.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The client performs silent automatic self-updates during normal execution, potentially replacing installed package files before carrying out the requested operation. Although the updater validates manifests and checksums, silent code replacement is security-sensitive because it changes trusted local code without a contemporaneous user prompt, making supply-chain compromise or unexpected behavior more dangerous in a tool whose stated purpose is image editing.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 88% confidence
• Finding: The script stores a bearer access token in plaintext JSON on disk, creating a durable credential artifact that can be reused by any process or user context able to read the file. Because the token is tied to the overly broad scope set, compromise of this file could grant extensive account capabilities unrelated to the skill's stated purpose.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 90% confidence
• Finding: Listing credentials.json among files this package may delete indicates direct handling of authentication material in a skill that should only edit images. Even though the code aims to clean up on uninstall, granting a content-editing skill access to shared credentials materially increases blast radius if the package is modified, abused, or executed unexpectedly.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 96% confidence
• Finding: The _device_token function reads an access token from credentials.json and returns it for use in revocation. Direct token access by a skill package is a sensitive credential-handling pattern unrelated to the image-realism use case and could enable unauthorized account or device actions if the code path is abused.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 98% confidence
• Finding: The skill explicitly exposes self-update functionality and elsewhere contains the code to download and replace its own package files. Self-modification is particularly risky in a skill advertised for image realism because it is outside the core purpose and creates a direct path for remote code changes, magnifying any upstream compromise or policy bypass into local code execution under the user's trust boundary.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.