AI Short Drama Shot Maker

• Outcome: Review
• Latest audit: Aug 21, 2026 · 7:21 AM UTC
• Version: 0.1.3

Overview

This skill is a disclosed Beatra video-generation workflow, but it also uses a broad persistent device token and installs silent self-updates by default.

Review this before installing if you are uncomfortable with a shared full-scope Beatra device token, default silent package updates, registration metadata, and paid credit spending after approval. Consider disabling automatic updates with the documented command, review the Beatra authorization page carefully, and revoke the device from the Beatra Console when you no longer use it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exercises broad capabilities including shell, network, file read/write, and environment access, but does not declare permissions up front. That creates a transparency and trust-boundary problem: users invoking a media-generation skill would not reasonably expect local file handling, credential use, remote uploads, and package modification behavior. In this context, the hidden breadth is especially risky because the skill also performs paid remote actions and local updater operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared skill purpose is narrow media generation, but the documented behavior includes OAuth login, persistent credential storage, remote tool execution, local file upload, telemetry/registration, uninstall/revocation, and self-update installation. This mismatch is dangerous because it masks sensitive operations behind an innocuous description, reducing informed consent and increasing the chance that users approve actions involving credentials, billing, or filesystem changes they did not anticipate.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill contains self-updating package-management behavior unrelated to the core task of generating a drama shot. Any self-update path materially expands the attack surface by allowing code replacement on the host, and here it is triggered as part of ordinary command execution rather than a clearly isolated maintenance workflow.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope string requests a broad set of capabilities far beyond a vertical drama-shot generator, including wallet spending, music, speech, voice management, task read/cancel, and general artifact access. This violates least privilege and means compromise or misuse of the granted token could enable actions unrelated to the advertised skill, increasing blast radius substantially.

Context-Inappropriate Capability

Critical

• Confidence: 93% confidence
• Finding: The tasks:cancel scope allows the skill to cancel tasks, which is not obviously required for a shot-generation authorization helper. Unneeded control-plane permissions can be abused to disrupt user workloads or interfere with other operations sharing the same account.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The tasks:cancel scope allows the skill to cancel tasks, which is not obviously required for a shot-generation authorization helper. Unneeded control-plane permissions can be abused to disrupt user workloads or interfere with other operations sharing the same account.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The tasks:cancel scope allows the skill to cancel tasks, which is not obviously required for a shot-generation authorization helper. Unneeded control-plane permissions can be abused to disrupt user workloads or interfere with other operations sharing the same account.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The tasks:cancel scope allows the skill to cancel tasks, which is not obviously required for a shot-generation authorization helper. Unneeded control-plane permissions can be abused to disrupt user workloads or interfere with other operations sharing the same account.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The client includes a full self-update mechanism that downloads remote manifests and archives and then mutates the local installation on disk, which is far beyond the stated purpose of a shot-generation skill. Even with integrity checks, this creates a remote code replacement channel whose compromise, misconfiguration, or abuse would let the package change behavior locally without the core creative action explicitly requiring it.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill records installation telemetry and a local inventory of installed skills, including platform and install path data, despite this functionality not being necessary for generating cinematic shots. This expands data collection and persistence in ways users may not expect, and could expose local environment details or support cross-skill tracking if the backend or local state is abused.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the host agent environment using environment variables and local host metadata to derive a platform identifier. For a shot-making skill this is not functionally necessary, and it increases privacy risk and enables environment-specific behavior or tracking that users may not reasonably anticipate.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that newer releases install automatically without separate confirmation. Silent code replacement is a serious supply-chain and user-consent risk: even with verification claims, the host may run changed code, alter files, or gain new behavior without the user intentionally approving that specific update. In a skill that already has shell, filesystem, network, and credential-related behaviors, this becomes more dangerous because an updated package can immediately exercise those powers.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that the client silently checks for updates and automatically installs a newer release without separate confirmation. Even though the text describes integrity checks and rollback protections, silent self-update that replaces installed files by default is still a security-relevant behavior because it modifies the local installation without explicit user approval at update time and can expand the impact of any compromise in the update channel or signing/trust process.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document states that the client automatically performs a best-effort installation registration on first use and transmits package slug, version, platform, and a stable external installation reference, but it does not describe any explicit user notice, consent flow, or opt-out. Even if the data is described as non-secret and non-billable, silent collection of persistent installation metadata can create privacy and tracking risk, especially because the stable external reference may enable correlation across sessions or environments.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: maybe_auto_update() performs silent background network checks, downloads, and package file replacement during normal command execution, while suppressing exceptions and avoiding user-facing disclosure. In the context of a creative media skill, hidden self-modification materially increases trust and supply-chain risk because the software can change itself outside an explicit update workflow.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

• Confidence: 92% confidence
• Finding: The manifest explicitly references a local credential file at ~/.beatra/credentials.json for MCP authentication. Exposing or depending on a fixed credential path increases the risk that the skill or surrounding tooling could access bearer credentials from the user's environment, enabling unauthorized API use or account compromise if those credentials are mishandled.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 94% confidence
• Finding: The CLI explicitly exposes self-update capability for the skill package, enabling local code replacement from remote sources. In this context, self-modification is risky because the skill's declared purpose is content generation, not software maintenance, so embedding an updater broadens the attack surface and creates a supply-chain execution path inside routine tooling.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.