ClawHub
Back to skill

Security audit

ai-multilingual-dubbing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real dubbing workflow, but it asks for broad account powers and can silently replace its own local code, so it needs careful review before installation.

Install only if you trust Beatra with a broad shared device token and with updating this local skill package. Before using it, consider disabling silent updates with the documented --auto off command, avoid invoking the upload command on sensitive files, and review account permissions and billing exposure because the token covers more than speech dubbing.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/authorize.py:34
Finding

Overprivileged Device Authorization and Unrestricted MCP Tool Dispatch

Content
View full analysis

Vulnerability Details

File Location: scripts/authorize.py:34-36; scripts/mcp_client.py:1463-1481
Vulnerability Type: Excessive authorization scopes and missing tool allowlist
Risk Level: High

Vulnerable Code

python
SCOPE = (
    "mcp:tools artifacts:write images:generate videos:generate music:generate "
    "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel"
)
python
def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]:
    session = _session_with_registration(
        state_dir=Path.home() / ".beatra",
        post_json=_default_post_json,
    )
    if command == "tools":
        return session.request(2, "tools/list", {})
    try:
        arguments = json.load(os.sys.stdin)
    except json.JSONDecodeError as exc:
        raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc
    if not isinstance(arguments, dict):
        raise RuntimeError("Tool arguments on stdin must be one JSON object")
    assert tool_name is not None
    return session.request(
        2,
        "tools/call",
        {"name": tool_name, "arguments": arguments},
    )

Technical Analysis

The declared Skill functionality is multilingual text-to-speech production. It reasonably requires speech synthesis, voice discovery, and limited task and artifact access. The requested authorization additionally grants image, video, and music generation; voice writing; general artifact writing; wallet spending; and task cancellation.

The command-line client compounds this excessive authorization by accepting any MCP tool name supplied as an argument. It does not enforce a package-specific allowlist. Consequently, the local client can use every operation exposed to the broadly scoped bearer token rather than only operations needed by this Skill.

This violates least privilege. The broad token is sha ...[truncated 1153 chars]

Remediation
View remediation

Remediation Suggestions

  • Issue a package-specific token limited to speech synthesis, voice reading, and the minimum task and artifact operations required to retrieve results.
  • Remove images:generate, videos:generate, music:generate, voices:write, broad artifacts:write, and wallet permissions unless a concrete Skill operation requires them.
  • Implement a local immutable allowlist of accepted MCP tools, such as the exact speech, voice-discovery, task-status, and cancellation operations documented by the Skill.
  • Reject unknown tool names before initializing a remote session.
  • Separate billable and non-billable tools and require explicit user authorization before every newly introduced category of paid operation.
  • Avoid sharing a full-scope credential between unrelated Skill packages.

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/mcp_client.py:969
Finding

Silent Remote Replacement of Audited Executable Skill Code

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:969-1021; supporting configuration at scripts/mcp_client.py:31-32
Vulnerability Type: Automatically retrieved and installed remote code
Risk Level: High

Vulnerable Code

python
PACKAGE_DISCOVERY_URL = "https://beatra.ai/skills/ai-multilingual-dubbing/channels/clawhub/install.json"
PACKAGE_CDN_BASE_TEMPLATE = "https://cdn.beatra.ai/agent-packages/ai-multilingual-dubbing/channels/clawhub/v{version}"
python
def maybe_auto_update(
    *,
    state_dir: Path | None = None,
    install_root: Path | None = None,
    get_bytes: GetBytes = _default_get_bytes,
    now: float | None = None,
) -> bool:
    """Best-effort silent update. Never block the requested MCP command."""

    resolved_state = state_dir or Path.home() / ".beatra"
    try:
        resolved_root = (install_root or _current_install_root()).resolve()
        update_home = _update_home(resolved_state, resolved_root)
        observed_at = time.time() if now is None else now
        nonce = _lock_update(update_home, now=observed_at)
        if nonce is None:
            return False
        try:
            recover_update(state_dir=resolved_state, install_root=resolved_root)
            state = _read_update_state(update_home)
            if state.get("auto_update", True) is False:
                return False
            last_checked = state.get("last_checked_at")
            if (
                isinstance(last_checked, (int, float))
                and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS
            ):
                return False
            state["last_checked_at"] = observed_at
            _write_private_json(update_home / "state.json", state)
            checked = check_update(get_bytes=get_bytes)
            if not checked["update_available"]:
                return False
            _ensure_owne
...[truncated 3045 chars]
Remediation
View remediation

Remediation Suggestions

  • Disable automatic executable updates by default.
  • Require explicit, informed user approval before replacing any Skill instruction or executable file.
  • Verify every release with a cryptographic signature rooted in a public key pinned in the reviewed package, not merely digests delivered by the same release service.
  • Prefer the host platform’s reviewed and signed package-update mechanism.
  • Display the source, current version, target version, and verified signer before installation.
  • Keep update checks separate from business commands so a user request cannot unexpectedly mutate code.
  • Continue retaining the existing path validation, file limits, backups, journaling, and rollback protections as defense in depth.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/authorize.py:340
Finding

Unnecessary Collection and Transmission of Host and Agent Environment Identifiers

Content
View full analysis

Vulnerability Details

File Location: scripts/authorize.py:340-369; transmission at scripts/authorize.py:455-467
Vulnerability Type: Environment fingerprinting beyond functional necessity
Risk Level: Medium

Vulnerable Code

python
def detect_host_platform(explicit: str | None = None) -> str:
    """The agent environment this process runs inside (docs/device-model.md).

    Order: explicit agent self-report > environment signatures > unknown.
    Detection reads the process environment only — nothing else runs,
    nothing reaches the network.
    """
    if explicit:
        candidate = explicit.strip().lower().replace(" ", "-")
        if _PLATFORM_VALUE.fullmatch(candidate):
            return candidate
    env = os.environ
    if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env:
        return "claude-code"
    if any(key.startswith("CODEX_") for key in env):
        return "codex"
    ai_agent = env.get("AI_AGENT", "").lower()
    matched = re.match(r"([a-z0-9-]+)_", ai_agent)
    if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)):
        return matched.group(1)
    return "unknown"


def device_display_name() -> str | None:
    """A hostname the user will recognise in the console device list."""
    try:
        name = socket.gethostname().strip()
    except OSError:
        return None
    if not name or not name.isprintable():
        return None
    return name[:120]
python
form: dict[str, str] = {
    "client_id": CLIENT_ID,
    "resource": MCP_URL,
    "scope": SCOPE,
    "platform": host_platform,
    "client_name": PACKAGE_DISPLAY_NAME,
    "external_installation_ref": external_reference,
    "package_version": PACKAGE_VERSION,
    "package_slug": PACKAGE_SLUG,
}
if device_name:
    form["device_name"] = device_name
status, created = post_form(DEVICE_AUTHORIZATION_URL, form)

Tec

...[truncated 1808 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not collect or transmit the operating-system hostname.
  • Use the existing random external installation reference or a user-selected generic device alias.
  • Make platform telemetry opt-in and explain the exact fields, recipients, retention, and purpose before collection.
  • Do not attach platform attribution to every business request unless technically required.
  • Minimize persisted host metadata and provide a command to inspect and delete it.
  • If a display label is needed, default to a non-identifying value such as Beatra device and allow the user to rename it in the service console.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/mcp_client.py:191
Finding

Unrestricted Local File Upload Primitive

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:191-224; upload operation at scripts/mcp_client.py:1428-1461
Vulnerability Type: Arbitrary readable-file transmission without path confinement
Risk Level: Medium

Vulnerable Code

python
def _read_local_upload(path: Path) -> tuple[str, bytes]:
    candidate = path.expanduser()
    descriptor = -1
    try:
        flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
        descriptor = os.open(candidate, flags)
        before = os.fstat(descriptor)
        if (
            not stat.S_ISREG(before.st_mode)
            or before.st_size < 1
            or before.st_size > MAX_UPLOAD_BYTES
        ):
            raise RuntimeError(
                f"Local upload must be one regular file between 1 and {MAX_UPLOAD_BYTES} bytes"
            )
        with os.fdopen(descriptor, "rb") as handle:
            descriptor = -1
            content = handle.read(MAX_UPLOAD_BYTES + 1)
            after = os.fstat(handle.fileno())
        stable_fields = ("st_dev", "st_ino", "st_size", "st_mtime_ns")
        if (
            len(content) != before.st_size
            or len(content) > MAX_UPLOAD_BYTES
            or any(getattr(before, field) != getattr(after, field) for field in stable_fields)
        ):
            raise RuntimeError("Local upload changed while it was being read")
    except RuntimeError:
        raise
    except OSError as exc:
        raise RuntimeError("Local upload must be one readable regular file") from exc
    finally:
        if descriptor >= 0:
            os.close(descriptor)
    return candidate.name, content
python
def upload(
    path: Path,
    *,
    mime_type: str,
    state_dir: Path | None = None,
    post_json: PostJson = _default_post_json,
    put_bytes: PutBytes = _default_put_bytes,
) -> dict[str, str]:
    if re.fullmatch(r"[a-z0-9][a-z
...[truncated 2886 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the upload command and upload scope from this text-only dubbing Skill if they are not required.
  • Otherwise, require explicit user confirmation that displays the canonical path, byte size, MIME type, and destination before reading or transmitting the file.
  • Restrict uploads to user-approved project or media directories.
  • Resolve the canonical path and reject paths outside approved roots.
  • Verify media type from file content rather than trusting a caller-provided MIME string.
  • Restrict presigned upload destinations to documented, allowlisted hostnames or tightly validated storage-domain patterns.
  • Apply a lower task-appropriate size limit and avoid retaining sensitive bytes longer than required.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mcp_client.py:1044
Finding

Windows Credential Confidentiality Guarantee Is Not Enforced

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:1044-1052; credential creation behavior at scripts/authorize.py:120-135
Vulnerability Type: Missing Windows ACL validation for bearer-token storage
Risk Level: Medium

Vulnerable Code

python
def _private_directory(path: Path) -> None:
    # POSIX gets explicit 700/600. On Windows the state directory lives under
    # the user profile, whose default ACL is already private to the user —
    # the same posture as gh/aws/gcloud credential stores. The former custom
    # DACL ceremony was dropped deliberately: its command patterns read as
    # hostile to agent safety policies and endpoint security, failing installs
    # while adding no protection an elevated administrator could not bypass.
    path.mkdir(mode=0o700, parents=True, exist_ok=True)
    if os.name == "posix":
        path.chmod(0o700)


def _restrict_file(path: Path) -> None:
    if os.name == "posix":
        path.chmod(0o600)
python
def _read_private_credentials(state_dir: Path, path: Path) -> str:
    if os.name == "nt":
        # The state directory lives under the user profile, whose default
        # ACL is already private to the user (the gh/aws/gcloud posture).
        # The former custom DACL verification was dropped deliberately: its
        # command patterns read as hostile to agent safety policies and
        # endpoint security, failing installs while adding nothing an
        # elevated administrator could not bypass.
        return path.read_text(encoding="utf-8")

The documentation states:

text
On Windows the current user must be the only principal granted access through
the file ACL.

Technical Analysis

POSIX systems receive explicit directory and file modes, and the MCP client validates ownership and permissions before reading the token. Windows systems receive neither equivalent access-control-list cre ...[truncated 1423 chars]

Remediation
View remediation

Remediation Suggestions

  • Create ~/.beatra and credentials.json with an explicit DACL granting access only to the current user and required system principals.
  • Validate the owner and effective ACL before every credential read, failing closed when unintended principals have access.
  • Prefer Windows Credential Manager or another operating-system-backed secret store instead of a plaintext JSON bearer-token file.
  • Use a safe native Windows API or a narrowly scoped, reviewed library rather than constructing shell commands for ACL management.
  • Correct the documentation if the project intentionally relies only on inherited profile ACLs, but recognize that this is weaker than the currently stated guarantee.
  • Reduce token scopes so disclosure of the credential has a smaller impact.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (43)

Context-Inappropriate Capability

Critical
Category
Not specified by scanner
Confidence
98% confidence
Finding

The helper asks for image, video, and music generation scopes even though the skill description is limited to multilingual dubbing audio creation. These extra creative-generation permissions expand what can be done with the bearer token and make token theft or misuse materially more damaging than necessary.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill appears to include uninstall/disconnect behavior, inventory inspection, credential/config deletion, token revocation, and shared connection lifecycle management that are outside the advertised dubbing purpose. Those administrative capabilities create opportunities for destructive or privacy-impacting actions under the cover of a creative workflow.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill appears to include uninstall/disconnect behavior, inventory inspection, credential/config deletion, token revocation, and shared connection lifecycle management that are outside the advertised dubbing purpose. Those administrative capabilities create opportunities for destructive or privacy-impacting actions under the cover of a creative workflow.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill appears to include uninstall/disconnect behavior, inventory inspection, credential/config deletion, token revocation, and shared connection lifecycle management that are outside the advertised dubbing purpose. Those administrative capabilities create opportunities for destructive or privacy-impacting actions under the cover of a creative workflow.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 71)May include surrounding context.

json
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The requested OAuth scope set is far broader than the skill’s stated purpose of multilingual dubbing from prepared scripts. Granting images, videos, music, wallet spending, task control, and voice write access violates least privilege and would let a compromised or misused skill act well outside dubbing, increasing blast radius significantly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The helper asks for image, video, and music generation scopes even though the skill description is limited to multilingual dubbing audio creation. These extra creative-generation permissions expand what can be done with the bearer token and make token theft or misuse materially more damaging than necessary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The client embeds a full self-update mechanism that downloads manifests and archives from remote infrastructure and then replaces local installation files. For a dubbing skill, self-modifying package behavior materially expands the trust boundary: any compromise of update infrastructure, signing/checksum workflow, or release process can turn ordinary skill execution into local code replacement.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The exposed self-update command enables local code replacement capability inside the skill package itself. Even with checksum validation, bundling self-modification into a content-generation skill creates a high-value supply-chain attack surface that is unrelated to the user-facing dubbing purpose and can persist malicious changes locally.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The presence of credentials.json in the targeted shared state indicates this skill is designed to manipulate credential-bearing files outside its own functional domain. Even though the script does not exfiltrate secrets, touching shared credential storage increases the blast radius of uninstall behavior and normalizes credential access in a package whose advertised purpose is audio dubbing.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

This uninstall code performs a privileged network action by revoking a shared device OAuth credential, which affects all skills using the shared Beatra connection rather than only this dubbing package. Although framed as cleanup, it extends the skill's capability beyond its stated dubbing purpose and can disrupt unrelated installed skills or central account connectivity if the shared-state assumptions are wrong.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This function reads access_token from ~/.beatra/credentials.json and uses it to authorize a revocation request, meaning the skill has direct access to bearer credentials for the shared device connection. In the context of a dubbing skill, direct credential access is overprivileged and dangerous because any compromise or modification of this script would allow unauthorized token use against the account control plane.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python
def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script deletes files in ~/.beatra including credentials, installation metadata, host state, skill inventory, and registrations, which are clearly shared application state rather than package-local dubbing data. Even with guard logic, an individual skill should not have authority to remove global state because mistakes, stale inventory, or path confusion could disconnect other skills and destroy auditability or recovery information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool restrictions despite clearly requiring shell, network, and local file capabilities via the bundled MCP client and update flow. Missing scope boundaries increases the chance the agent can invoke broader capabilities than users expect, which is especially risky because the skill also performs installation, auth, and update actions unrelated to simple dubbing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The description explicitly promotes 'Chinese, English, and Japanese dubbing,' which can read as a preset language constraint rather than a user-selected locale choice. Because language/locale restrictions should be opt-in or clearly justified, this wording may violate the language-choice policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill documents silent self-update behavior that downloads and replaces local package-owned files before ordinary commands. Even with integrity checks, automatic code modification unrelated to the core dubbing task expands the trust boundary and creates a software supply-chain and local persistence risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Installing updates without a contemporaneous warning means the skill can modify local files during normal use without informed consent. In the context of a creative dubbing skill, that behavior is unexpected and makes any compromise of the update channel or publisher account substantially more dangerous.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json
"icon": "https://beatra.ai/textures/icons/ai-multilingual-dubbing.png",
  "localized": {
    "en": {
      "description": "Create multilingual voice-over audio from prepared scripts for videos, product launches, e-learning, training libraries, creator content, and international campaigns. This AI multilingual dubbing workflow organizes every market and segment, helps choose a locale-ready voice, pilots pronunciation and timing, and delivers reviewable narration by language. Use it for AI video dubbing audio, AI video translation audio, video localization voice-over, training video localization, global marketing narration, text to speech in multiple languages, or Chinese, English, and Japanese dubbing. Receive narration tracks organized by language, market, and segment, ready for localization editing, lip-sync production, training libraries, and campaign assembly.",
      "display_name": "AI Multilingual Dubbing",
      "summary": "Create reviewable multilingual voice-over audio from scripts for each language, with deliberate casting, pronunciation and timing pilots, and delivery organized by market and segment.",
      "tags": [

Static analysis

No suspicious patterns detected.