AI Photo Restyler

• Outcome: Review
• Latest audit: Aug 20, 2026 · 12:27 PM UTC
• Version: 0.1.3

Overview

This photo restyling skill is mostly coherent, but it asks for broad Beatra account authority and silently updates its own code, so it needs Review before installation.

Install only if you are comfortable granting this package a shared Beatra device token with broad Beatra capabilities, not just photo editing. Review the requested scopes and consider disabling silent updates with `python3 scripts/mcp_client.py update --auto off` after installation if you need tighter change control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares no permissions while instructing use of a bundled Python client that performs shell execution, file access, network calls, local credential handling, and package mutation. That mismatch removes an important trust boundary for users and hosts, making the skill more dangerous because broad capabilities are present without explicit disclosure or least-privilege scoping.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented purpose is photo restyling, but the skill also includes authentication flows, persistent credential storage, generic remote tool invocation, telemetry/registration, uninstall logic, and self-update/package replacement. This broad hidden behavior materially expands the attack surface and user risk beyond what the description suggests, especially because generic MCP invocation plus stored credentials can be abused for actions unrelated to image editing.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill advertises silent automatic updates that download and replace package-owned files without separate confirmation. Even with stated verification, a self-updating mechanism inside a content-transformation skill is highly sensitive because it creates a software supply-chain path that can modify executable behavior after approval, increasing risk from compromise, misconfiguration, or trust failures in the update channel.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope set is far broader than the skill’s stated purpose of photo restyling. It includes unrelated capabilities across images, videos, music, speech, voices, wallet spending, and task/artifact operations, violating least privilege and creating unnecessary blast radius if the skill, its environment, or stored token is abused.

Context-Inappropriate Capability

Critical

• Confidence: 91% confidence
• Finding: `tasks:read` and `tasks:cancel` are not obviously required for a simple photo restyling skill and may expose or interfere with unrelated user workflows. While less severe than wallet access, these scopes still broaden operational control beyond the stated purpose and can leak metadata or disrupt jobs.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: `tasks:read` and `tasks:cancel` are not obviously required for a simple photo restyling skill and may expose or interfere with unrelated user workflows. While less severe than wallet access, these scopes still broaden operational control beyond the stated purpose and can leak metadata or disrupt jobs.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: `tasks:read` and `tasks:cancel` are not obviously required for a simple photo restyling skill and may expose or interfere with unrelated user workflows. While less severe than wallet access, these scopes still broaden operational control beyond the stated purpose and can leak metadata or disrupt jobs.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: `tasks:read` and `tasks:cancel` are not obviously required for a simple photo restyling skill and may expose or interfere with unrelated user workflows. While less severe than wallet access, these scopes still broaden operational control beyond the stated purpose and can leak metadata or disrupt jobs.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file embeds a full package discovery, download, validation, and replacement mechanism that can silently modify the installed skill, which is far outside the stated photo-restyling function. Even with checksum and path checks, this substantially increases the attack surface: compromise of the update infrastructure or signing/discovery channel would let an attacker ship new code into the agent environment under the guise of a creative skill.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill performs installation registration, keeps local inventory, and sends package/platform telemetry unrelated to transforming photos. This creates unnecessary data collection and expands the trust boundary, exposing usage and environment metadata to a remote service without being essential to the advertised functionality.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code fingerprints the host environment using environment variables and local state to classify the agent platform, which is not needed for photo restyling. Such fingerprinting enables tracking, environment-aware behavior, and potential tailoring of follow-on actions to specific agent hosts, making unrelated capabilities more dangerous in this skill context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The CLI path accepts arbitrary JSON on stdin and forwards it to arbitrary remote Beatra tools via tools/call, effectively making this package a generic remote tool broker rather than a narrowly scoped photo-restyling client. In the context of a creative image skill, that scope mismatch is dangerous because any future or hidden backend tool exposed through the same credentials becomes reachable through this package.

Context-Inappropriate Capability

High

• Confidence: 84% confidence
• Finding: The script is able to delete shared files under ~/.beatra, including credentials and inventory for all skills, not just this package. Although the implementation is cautious and only removes them when it believes no other skills remain, this still grants a photo-restyling skill lifecycle code access to cross-skill shared state; if the inventory is wrong, tampered with, or incomplete, uninstalling this skill could disrupt other installed skills or remove shared credentials unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 80% confidence
• Finding: The script can send the shared device access token to a remote revocation endpoint during uninstall. Even though the endpoint is hardcoded to the vendor domain and redirects are rejected, this still gives package code the ability to invalidate a shared authorization for the entire device, which can cause denial of service for other skills if the local inventory is stale or maliciously altered.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document states that the client silently checks for updates and installs newer versions automatically by default without separate confirmation. Even with checksum, path, and rollback protections, this is still a security-relevant supply-chain behavior because it modifies local files automatically and may violate user expectations, reduce administrative control, and increase blast radius if the update channel or signing/verification process is ever compromised.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that the client automatically performs a registration call and writes a local cache file on first use, but it does not explicitly warn users about outbound telemetry-like transmission or filesystem modification before use. This is risky because silent network reporting and local state changes can violate user expectations, organizational policies, or privacy requirements even if the transmitted data is described as non-secret and non-billable.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: maybe_auto_update() performs best-effort silent updates during normal execution without a user-facing prompt at the time code is replaced. Silent code modification reduces transparency and can undermine user expectations and review processes, especially for an image-restyling skill that should not need to alter its own executable files when invoked.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill records local inventory and sends installation telemetry as a background behavior without clear runtime disclosure to the user. While not direct code execution, undisclosed collection of install path, platform, and registration state is a trust and privacy issue made more concerning because it is unrelated to the advertised styling task.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 87% confidence
• Finding: This function reads an access token from ~/.beatra/credentials.json so the package can revoke shared device authorization. Accessing shared credentials from within a skill uninstaller violates least privilege for a photo-restyling package and creates cross-skill blast radius: compromised or modified uninstall code could misuse the token, and even intended use can disable other skills if state tracking is inaccurate.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The package explicitly exposes self-update/self-modification functionality, allowing installed code to replace itself on disk. In a skill marketed for photo restyling, self-modification is unjustified and materially raises risk because any compromise of the update path or abuse of the feature can convert a benign creative tool into a persistent code delivery mechanism.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.