ai-music-video-clip-maker

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:08 AM UTC
• Version: 0.1.4

Overview

The skill’s core music-video workflow is coherent, but it also uses broad Beatra account permissions and silent self-updates that users should review before installing.

Review this before installing if you are uncomfortable with a shared Beatra device token that can spend credits and access more Beatra media capabilities than this single music-video workflow needs. The skill can upload user-selected local media, stores Beatra state under ~/.beatra, registers install metadata, and silently auto-updates by default; use the documented auto-update off command if you install but want manual updates.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares itself as a content-generation workflow, but its instructions require broad capabilities including shell, network, file read/write, and environment access without any explicit permission declaration or narrowing. That creates an oversized trust boundary: the host may grant powerful capabilities to a skill whose user-facing description does not communicate that it can upload local files, manage credentials, or modify local state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior goes far beyond making music video clips: it includes OAuth/device auth, browser-based approval, credential persistence, telemetry/installation registration, arbitrary file upload, generic remote MCP invocation, uninstall logic, and self-updating package replacement. This mismatch is dangerous because users and host systems may authorize the skill under a narrow creative-use assumption while it actually performs sensitive system and network operations with privacy and integrity implications.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes a self-updating mechanism that downloads newer releases and replaces package-owned files, which is unrelated to the core task of generating music clips. Even with integrity checks described, automatic code replacement materially increases supply-chain risk: compromise of the update channel, signing pipeline, or package distribution could turn normal skill invocation into silent execution of newly delivered code.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest presents a media-generation tool, but the documented execution path modifies local package files via automatic updates. That hidden system-modifying behavior weakens informed consent and expands the attack surface from content generation to local software maintenance, which is a materially different trust model.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The authorization helper asks for speech:generate, voices:read, and voices:write despite the skill being described primarily as a music-video clip maker. Unnecessary voice and speech permissions broaden the blast radius of any token compromise and create a mismatch between user expectations and actual access.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The authorization helper asks for speech:generate, voices:read, and voices:write despite the skill being described primarily as a music-video clip maker. Unnecessary voice and speech permissions broaden the blast radius of any token compromise and create a mismatch between user expectations and actual access.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The script detects host platform from environment variables, captures a device name, and maintains a local inventory of installed skill paths. While not exfiltrated in this snippet, this exceeds the narrow purpose of authorizing a music-video tool and creates unnecessary collection of environment and installation metadata that could aid profiling or later misuse.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The client contains substantial self-update and installation-management logic unrelated to the declared music-video clip-making purpose. Functionality creep like this increases the trusted attack surface: a creative tool invocation can lead to package discovery, archive download, manifest processing, and local file replacement, which creates supply-chain and integrity risks if the update channel or package state is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The client records installation telemetry and a local skills inventory that are not necessary for the stated clip-generation behavior. While not overtly malicious, collecting and persisting platform/install metadata without clear necessity or disclosure expands privacy exposure and creates an undocumented data flow to the remote service.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The code fingerprints the host environment by inspecting environment variables and cached host metadata, even though this is not justified by the stated music-video creation purpose. In context, this increases privacy and tracking risk and provides extra host-context data to remote calls without clear user benefit.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that silent checks are enabled by default and that newer releases install without separate confirmation, while the description does not clearly warn users that invoking the skill may cause local software changes. Silent auto-update of executable package content is dangerous because it reduces user visibility and approval over code changes and can convert a routine media task into an unannounced software replacement event.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer releases without separate confirmation, which is a system-modifying action performed by default. Even though the text describes integrity controls, the default silent replacement of installed package files materially affects the user's environment and is not presented with an explicit upfront warning or opt-in, creating supply-chain and unauthorized-change risk if the update path or trust assumptions fail.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document specifies automatic installation registration to a backend and creation of a local cache file, but it does not mention a user-facing notice, consent flow, or clear disclosure that telemetry-like metadata will be transmitted and persisted locally. Even if the data is described as non-secret and non-billable, package slug, version, platform, and a stable external installation reference can still enable tracking or unexpected data collection, especially in enterprise or privacy-sensitive environments.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: Host metadata is written to disk in host.json without any visible notice, consent, or clear user disclosure. Although the data appears limited, silent persistence of platform and device information can undermine user trust and contributes to avoidable privacy risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: maybe_auto_update() performs silent package updates before normal commands, allowing local installation files to be modified without an execution-time prompt. Even though the update flow includes checksums and path validation, silent self-modification is risky in a skill whose advertised purpose is media creation, because compromise of the vendor update infrastructure or account could transparently alter executable code on user systems.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The client sends installation telemetry including package version, detected platform, and an external installation reference as part of registration, without obvious user-facing disclosure at execution time. In a media-generation skill, this is more suspicious because the data transfer is ancillary to the user-requested function and can facilitate tracking across installs or hosts.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 94% confidence
• Finding: The skill exposes self-update capability that can replace package files on disk, which is a self-modification mechanism. In the context of a creative skill, this is unusually dangerous because it gives the package the ability to change its own code footprint post-installation, increasing supply-chain risk and reducing user control over what code executes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.