AI Music Video Clip Maker

• Outcome: Review
• Latest audit: Oct 12, 2026 · 9:51 AM UTC
• Version: 0.2.0

Overview

The skill matches its music-video purpose, but it uses a shared broad Beatra credential and silently self-updates its local package files by default, so it should be reviewed before installation.

Install only if you are comfortable trusting Beatra's service and update channel with uploaded media, paid generation requests, wallet spending authority, and a shared local Device Token. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, keep `~/.beatra/credentials.json` private, and use the uninstall workflow if you later want the shared connection removed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill references uninstall and disconnect operations that read and modify local filesystem state, inspect installed skill inventory, access credential/token files, revoke authorization remotely, and delete local state. Those are privileged lifecycle-management actions unrelated to ordinary clip generation, and hiding them inside the same skill increases the risk of unexpected destructive or privacy-impacting behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill references uninstall and disconnect operations that read and modify local filesystem state, inspect installed skill inventory, access credential/token files, revoke authorization remotely, and delete local state. Those are privileged lifecycle-management actions unrelated to ordinary clip generation, and hiding them inside the same skill increases the risk of unexpected destructive or privacy-impacting behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill references uninstall and disconnect operations that read and modify local filesystem state, inspect installed skill inventory, access credential/token files, revoke authorization remotely, and delete local state. Those are privileged lifecycle-management actions unrelated to ordinary clip generation, and hiding them inside the same skill increases the risk of unexpected destructive or privacy-impacting behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 67)May include surrounding context.

json

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

md

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

md

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 53)May include surrounding context.

md

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 430)May include surrounding context.

python

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 1009)May include surrounding context.

python

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1612)May include surrounding context.

python

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 39)May include surrounding context.

python

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 121)May include surrounding context.

python

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The document explicitly directs all packages to share a single full-scope device token from ~/.beatra/credentials.json, which creates broad credential exposure across packages and increases blast radius if any package, skill, or local process is compromised. Even though the text says not to print or move the token, centralizing a reusable bearer credential for all packages is still dangerous because unauthorized access to that file enables full-scope API actions and cross-package impersonation.

Content

Scanner excerpt · references/mcp-connection.md (reported line 12)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill requests tasks:read and tasks:cancel even though the description focuses on generating short music promo visuals. Unrelated task-management permissions can expose metadata about other user jobs or allow disruption of unrelated workflows if the token is abused.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The skill supports self-modification through an update command and silent auto-update flow, allowing remote package replacement on the local system. In an agent skill, self-updating is especially dangerous because it enables post-install behavior changes outside the original review scope; if the update infrastructure or vendor account is compromised, the skill can become a delivery path for malicious code.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 2396)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands, reads local files, uploads local media, performs network calls, and can modify package-owned files via its updater, yet it declares no explicit tool scope or permission boundaries. That makes the effective capability set much broader than a user or host may expect, increasing the risk of unintended file access, data exfiltration, or code execution pathways through the bundled client.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation language is broad and encourages use across many adjacent media tasks, while trigger boundaries are defined only later in the document. Ambiguous activation criteria can cause the agent to invoke a high-capability skill in situations where a lower-risk or more appropriate workflow should have been used, increasing accidental uploads, billing actions, or privileged client use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables silent automatic updates by default and states that newer releases install without separate confirmation. Even with integrity checks, auto-replacement changes executable behavior over time without a fresh user decision, which increases supply-chain risk and undermines predictability for a skill that already has shell, file, and network capabilities.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json

"icon": "https://beatra.ai/textures/icons/ai-music-video-clip-maker-0.1.1.png",
  "localized": {
    "en": {
      "description": "Create a short visual clip guided by a song's mood, rhythm, and visual concept. This AI music video clip maker and song-to-video generator turns a music excerpt and visual direction into a cinematic music promo clip, animates approved cover art or a portrait in time with the music, interpolates motion between opening and ending art, or uses audio as a loose mood reference for a new visual concept. Use it for new-song teasers, album promo clips, cover art animation, mood visuals, virtual performer scenes, and social music teasers, with an audio-visual map built from the song's hook, energy, palette, and landing image.",
      "display_name": "AI Music Video Clip Maker",
      "summary": "Create a short visual clip guided by a song's mood and rhythm — turn a music excerpt and visual direction into a cinematic promo clip, animate cover art in time with the music, or build a mood visual from loose references.",
      "tags": [

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document states that update checks are silent, enabled by default, and that higher versions are installed automatically without separate confirmation. Even with integrity checks and rollback protections, silent self-updating changes installed files without explicit runtime consent or a prominent warning about system modification, which can undermine user autonomy and create supply-chain risk if the trusted update path is ever compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 106)May include surrounding context.

md

- say prominently that a signed-out browser lands on Beatra sign-in first:
  the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
  ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
  in [MCP connection](mcp-connection.md#network-route).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 132)May include surrounding context.

md

Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.

## Use the bundled MCP client

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation states the package records interface language/locale and other runtime metadata during installation registration without any user opt-in or necessity tied to the core music-video functionality. While the data is described as coarse and non-blocking, locale/language can still be privacy-sensitive telemetry and contribute to fingerprinting when combined with platform, network route, install source, and installation reference.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requests tasks:read and tasks:cancel even though the description focuses on generating short music promo visuals. Unrelated task-management permissions can expose metadata about other user jobs or allow disruption of unrelated workflows if the token is abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requests tasks:read and tasks:cancel even though the description focuses on generating short music promo visuals. Unrelated task-management permissions can expose metadata about other user jobs or allow disruption of unrelated workflows if the token is abused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.