ClawHub
Back to skill

Security audit

ai-storyboard-generator

Security checks across malware telemetry and agentic risk

Overview

This storyboard skill is mostly coherent, but it uses broad Beatra account permissions, shared credential state, and silent self-updates that should be reviewed before installation.

Install only if you are comfortable giving this package a shared full-scope Beatra device authorization, allowing local ~/.beatra state, and accepting default-on silent package updates. Disable automatic updates with the documented update command if you need review-before-change behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill exposes broad operational capabilities—shell, network access, file read/write, environment access—without declaring permissions or tightly constraining how those capabilities are used. In this context, the skill is instructed to invoke a bundled Python client, upload local files, persist state, and perform updates, which materially increases the attack surface and removes transparency for users and hosts about what privileged actions the skill may take.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill's stated purpose is storyboard planning and key-frame generation, but the content also directs OAuth login, credential storage, generic remote tool invocation, local file upload, telemetry/registration, uninstall cleanup, and automatic package updates. That mismatch is dangerous because users may grant trust for a creative workflow while the skill performs broader system and account-affecting operations they would not reasonably expect, including code/package changes via auto-update.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The authorization scope is far broader than the skill’s stated storyboard-planning purpose: it requests wallet spending, task control, voice management, and multiple media-generation capabilities unrelated to a minimal storyboard workflow. Excessive OAuth scopes increase blast radius if the token is misused or stolen, and violate least-privilege expectations for users installing a narrowly described skill.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script fingerprints the host environment and persists platform and device hostname data even though that metadata is not necessary to perform basic storyboard generation. Collecting and storing host-identifying information expands privacy exposure and can support device tracking or profiling beyond user expectations for this type of creative skill.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Maintaining a local inventory of installed skills and their absolute install paths creates unrelated system metadata that can reveal user tooling, filesystem layout, and usage patterns. For a storyboard skill, this exceeds expected function and increases privacy and reconnaissance value if local state is later accessed by another process or attacker.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The client contains extensive self-update, package download, archive validation, installation replacement, rollback, and state-management logic that is unrelated to a storyboard-generation skill's stated purpose. Even though there are multiple safety checks, bundling autonomous code replacement into a creative skill materially expands the trust boundary and gives the package the ability to modify itself on disk, which is dangerous in contexts expecting a narrow-purpose tool.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill records local inventory in ~/.beatra/skills.json and sends installation registration telemetry, including package/version/platform and an external installation reference, despite presenting itself as a storyboard-generation utility. This creates undisclosed device-level tracking and inventory behavior that is unnecessary for the advertised function and increases privacy and operational risk.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The code fingerprints the host environment by inspecting environment variables and host.json to infer whether it is running under Claude Code, Codex, or another platform, then propagates that information in requests and registration flows. For a storyboard skill, this is context-inappropriate metadata collection that broadens environment awareness beyond what is needed for creative generation and can support tracking or environment-specific behavior.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The uninstall flow can revoke a shared device token and remove the entire shared ~/.beatra state, affecting other skills on the device rather than only this storyboard package. Even though the code includes guardrails to avoid revoking when other skills appear present, this is still security-sensitive behavior outside the declared storyboard-generation capability and creates cross-skill impact if inventory/state is wrong, tampered with, or misunderstood by users.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This code performs a network revocation of a bearer token against a remote authorization endpoint, which is unrelated to storyboard generation and gives the skill authority over device credentials. Any skill that can trigger credential revocation expands its power beyond its functional scope and could disrupt access for the user or other installed skills if the surrounding assumptions fail.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script deletes shared local state files including credentials and inventory under ~/.beatra, not just files owned by this skill. Although it avoids recursive deletion and tries to preserve state on uncertainty, deleting shared connection state from within an application-specific skill creates unnecessary authority and can break unrelated skills or erase audit/useful recovery state.

Credential Access

High
Category
Privilege Escalation
Content
def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):
Confidence
90% confidence
Finding
This function reads an access token from shared credentials.json so the skill can present it to a remote revocation endpoint. Direct access to bearer tokens from within a storyboard skill exceeds least privilege and increases the blast radius if the package is modified, abused, or executed unexpectedly, because possession of the token enables security-relevant actions over the shared device authorization.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
96% confidence
Finding
The exposed CLI includes a self-update command and the program also performs silent automatic updates during normal execution, meaning the skill can replace its own package files on disk. In the context of a storyboard generator, self-modification is especially risky because users and hosting agents may reasonably expect static behavior, while auto-updating code can change capabilities, introduce supply-chain risk, and bypass normal review expectations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.