AI Video Continuation

• Outcome: Review
• Latest audit: Aug 21, 2026 · 7:09 AM UTC
• Version: 0.1.6

Overview

The skill’s video-extension workflow is coherent, but it grants and maintains broader Beatra account authority than a single video-continuation skill needs.

Install only if you are comfortable granting this Beatra package a shared, broad Beatra device token and allowing silent package updates by default. Before use, consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, and review Beatra account/device access because the authorization covers more than video continuation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions while instructing use of capabilities equivalent to shell execution, file access, network access, environment use, and file modification through the bundled Python client and updater. This creates a trust and review gap: operators may approve the skill as low-risk while it can upload local files, store credentials, and modify package-owned files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is a narrowly scoped video-extension workflow, but the skill also includes authentication flows, persistent credential storage, telemetry/registration, arbitrary MCP tool invocation via a client, upload capability, uninstall behavior, and self-update logic. That mismatch is dangerous because users and reviewers may not anticipate account linkage, data exfiltration, local persistence, or code-changing behavior when enabling what appears to be a simple media-editing skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The OAuth scope string requests many powerful capabilities unrelated to a video continuation skill, including wallet spending, voice access, music generation, task control, and broad artifact access. If the credential is compromised or the skill later abuses the granted token, the blast radius is far beyond the declared functionality, violating least-privilege and making account compromise substantially more damaging.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The client includes a built-in self-update mechanism that downloads code from remote discovery and CDN endpoints and replaces package files on disk, plus installation tracking and telemetry unrelated to the declared video continuation purpose. Even though there are integrity checks, this materially expands the trust boundary and gives the package remote code replacement capability, which is dangerous for an agent skill expected to perform a narrow media workflow.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the host environment using environment variables and local state, then injects source_package_slug and source_platform into business tool calls. This creates unnecessary agent/environment attribution unrelated to video continuation and increases privacy and tracking risk, especially because it is attached automatically to normal operations.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The client records a local inventory of installed skills and paths for uninstall and credential decisions, which exceeds the stated video-editing purpose and creates additional local surveillance/statefulness. Such inventory can reveal user tooling and filesystem layout and may later be consumed by unrelated flows without clear user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file implements a standalone uninstall workflow that manages shared Beatra connection state and device revocation, which is unrelated to the advertised video-continuation functionality. Even if intended as lifecycle management, this introduces privileged behavior outside the skill’s user-facing scope and creates risk if invoked unexpectedly or by an agent that did not clearly obtain user consent.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This code can send a bearer token to a remote revocation endpoint and disable a shared device authorization, a capability not justified by a video-editing skill’s operational purpose. Because the authorization is shared across skills, misuse or accidental execution could disrupt other installed skills and create a denial-of-service condition for the user.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script enumerates and deletes shared local Beatra state files, including inventory and registration data used by multiple skills. Although it tries to do so conditionally, embedding this behavior in a video skill expands the package’s authority beyond its stated purpose and could remove shared state unexpectedly if the logic is wrong or the environment is manipulated.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that silent update checks are enabled by default and that newer releases install without separate confirmation. Even with integrity checks, unattended self-update changes executable behavior after approval and increases supply-chain and change-management risk, especially because the skill can perform networked operations and handle credentials and local files.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document explicitly states that the client performs silent automatic update checks and installs higher versions automatically without separate confirmation. Even though it describes integrity checks and rollback protections, silent self-updating software that modifies installed files before ordinary commands materially changes the system and can violate user expectations, create supply-chain risk concentration, and reduce the chance a user notices unexpected behavior changes.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The authorization request sends installation and device-identifying metadata such as platform, device name, package slug/version, and external installation reference to remote endpoints without clearly informing the user beforehand. While not a direct code-execution issue, it creates avoidable privacy and tracking exposure, especially because this is an authorization helper where users may reasonably expect only sign-in data to be shared.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 90% confidence
• Finding: The function reads an access token from credentials.json and uses it to perform an authenticated revocation call. Accessing shared credentials from within a skill package is sensitive because any code path that can read bearer tokens can potentially misuse them, and in this context the capability is unrelated to video continuation functionality.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 93% confidence
• Finding: The package exposes self-update functionality that can modify its own installed code, and automatic update checks may run during normal command execution. In an agent-skill context, self-modification is especially risky because it allows behavior changes outside normal review and deployment controls, undermining the expectation that a media-editing skill remains static and purpose-limited.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.