Back to skill

Security audit

ai-multilingual-dubbing

Security checks across malware telemetry and agentic risk

Overview

This dubbing skill mostly matches a Beatra text-to-speech workflow, but it also installs silent self-updates and requests broad shared Beatra authority beyond dubbing.

Review this skill before installing if you are uncomfortable with a Beatra shared token that can access more than speech generation, or with package files being updated automatically. If installed, consider disabling silent updates with `python3 scripts/mcp_client.py update --auto off`, use it only with Beatra credentials you intend to share across Beatra skills, and confirm paid render matrices carefully before synthesis.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill advertises a content-production workflow but invokes a bundled Python client for remote operations and documents capabilities that imply shell, network, and local file access without declaring permissions. This creates a hidden trust boundary: users may invoke code-capable behavior, including networked actions and local state changes, without clear consent or sandbox expectations.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The documented behavior materially exceeds the stated purpose of multilingual dubbing by including OAuth authorization, credential storage, arbitrary remote MCP tool invocation, file upload, telemetry/registration, self-update, and uninstall/cleanup logic. Such hidden non-core behavior increases attack surface and can be used to access external services, persist secrets, modify the local installation, or exfiltrate data under the guise of a media workflow.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The skill includes silent self-update and package file replacement behavior unrelated to its primary dubbing task. Any mechanism that can replace local package files expands the blast radius from content generation to code execution and persistence, especially if triggered automatically during routine use.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
Automatic code download and installation are unjustified for a dubbing workflow and create a direct software supply-chain risk. Even with described verification checks, a compromised upstream, signing path, identity configuration, or client bug could lead to arbitrary code being installed locally without the user intentionally requesting an update.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The requested OAuth scope is far broader than the skill’s stated multilingual dubbing purpose. In addition to speech- and voice-related permissions, it asks for wallet spending, music generation, image/video generation, and task/artifact controls, which violates least privilege and would let a compromised or misused skill perform unrelated costly or sensitive actions.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The authorization helper collects and persists host platform, device name, and a local inventory of installed skills, which is beyond what is necessary to obtain a token for dubbing. While written locally, this creates extra sensitive metadata that could later be exposed, correlated, or reused by other components, increasing privacy and surveillance risk without a clear functional need tied to the declared skill purpose.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
The client contains a full self-update subsystem that downloads manifests and archives from the network and mutates the local installation, which is outside the expected scope of a multilingual dubbing skill. Even with checksum and path checks, this materially expands the trust boundary and gives the package the ability to change its own code after installation, increasing supply-chain and persistence risk.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill records installation telemetry and local skill inventory data unrelated to generating dubbing audio. This creates unnecessary collection of device-local metadata and outbound registration behavior, which broadens privacy exposure and can enable tracking of installations beyond the stated functionality.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code fingerprints the host environment by inspecting agent-related environment variables and local host metadata, then propagates that platform identifier in requests and telemetry. For a dubbing workflow, this is unnecessary contextual collection and increases the ability to identify, segment, or track execution environments.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This uninstall script performs cross-skill credential and shared-state management that is outside the advertised multilingual dubbing function of the skill. Even if framed as cleanup logic, it touches a shared device connection used by other skills, which expands the trust boundary and creates risk of unintended credential revocation or local state destruction if the inventory is wrong or manipulated.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code actively performs device authorization revocation over the network and manages cross-skill shared state, behavior unrelated to dubbing generation itself. In the context of a content-production skill, hidden account/device-management capabilities are risky because they allow the package to affect other installed skills and the user’s broader platform access during uninstall.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that update checks and installs may happen silently before ordinary commands, but it does not provide an in-flow warning that local files may be modified. Silent local modification undermines informed consent and makes it harder for users or administrators to distinguish expected behavior from tampering.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation. Even though it describes integrity checks and rollback protections, silently replacing installed files modifies the local system without clear upfront user consent at the time of installation or first use, which creates supply-chain and trust risks if the update channel is ever compromised or misconfigured.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The code writes host metadata, including platform and device name, to disk silently and on a best-effort basis, with no user-facing notice in this file. Even though the data is local and limited, undisclosed persistence of environment details is a privacy concern and can aid host fingerprinting if the state directory is later accessed by another process.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The skill silently records a local inventory of installed skills and install paths without explicit disclosure. This expands the data collected beyond authorization and may reveal local filesystem layout and usage history, which is unnecessary for a narrowly scoped dubbing workflow and increases privacy risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill performs silent automatic updates on normal execution paths and suppresses exceptions, meaning local code can change without a user-facing prompt at runtime. In the context of an agent skill, hidden mutation reduces auditability and can facilitate unnoticed delivery of new behavior, which is especially risky because the skill's advertised purpose is just dubbing/audio generation.

Credential Access

High
Category
Privilege Escalation
Content
def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):
Confidence
89% confidence
Finding
This function reads the shared access token from ~/.beatra/credentials.json and uses it to perform a privileged revocation request. Although not exfiltrating the token, direct access to shared credentials from within a skill package is dangerous because any compromise, modification, or repurposing of the script gives the skill access to platform-wide authorization material beyond its stated dubbing role.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
95% confidence
Finding
The presence of a self-update command confirms the package can modify its own installed code, which is a strong self-modification capability not justified by the stated dubbing function. In an agent-skill setting, self-modification is dangerous because it can bypass normal review expectations and turn a one-time-vetted package into a moving target.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.