ai-video-image-music-studio

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:15 AM UTC
• Version: 0.1.8

Overview

The skill is a coherent Beatra media-generation integration, but it silently self-updates installed package code by default and persists a broad Beatra device token, so users should review it before installing.

Install only if you are comfortable connecting a Beatra account, storing a local Beatra device token, uploading selected media files to Beatra, and allowing Beatra credits to be spent after the skill’s confirmation gates. Consider running `python3 scripts/mcp_client.py update --auto off` if you require each installed skill version to remain fixed until you update it yourself.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the host to use shell commands, local file access, network communication, credential handling, and package mutation, yet no explicit permissions are declared. This weakens user and platform visibility into the real trust boundary and can enable over-privileged execution without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The published description presents a media-generation skill, but the instructions also cover OAuth authorization, persistent credential storage, generic remote tool invocation, local file upload, automatic updates, registration telemetry, and uninstall/cleanup behavior. That mismatch can mislead users and reviewers about the actual capabilities and trust implications of installing or invoking the skill.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The client can silently download and replace its own installed package files through maybe_auto_update()/update_package(), behavior that is materially outside the stated media-generation purpose and not clearly disclosed in the skill description. Even though the updater includes integrity checks, a self-modifying agent component increases supply-chain and trust risk because future behavior can change without explicit user review at execution time.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The code records local skill inventory and sends installation telemetry/registration metadata to the remote service, which is unrelated to the skill's advertised creative media workflow and is not user-visible in this path. This creates privacy and transparency concerns because host platform, install path, package version, and installation identifiers are persisted and transmitted without clear consent or necessity for the core task.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill permits silent automatic updates that download and replace package-owned files from remote infrastructure without per-update user confirmation. Even with stated verification, this introduces a supply-chain and local code-modification risk because future code can change behavior after initial trust is granted.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The manifest prominently advertises voice cloning functionality but provides no user-facing notice about consent, impersonation risk, or privacy requirements. In a media-generation skill, that omission increases the chance of misuse against third parties whose voices may be cloned without authorization, creating legal, privacy, and abuse risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document states that the client silently checks for updates and installs newer versions automatically without separate confirmation. Even with integrity checks and fixed update sources, this behavior modifies local code by default, which reduces user control and can create a supply-chain risk if the trusted update infrastructure or signing pipeline is ever compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Automatic silent self-update rewrites package files during normal execution without a runtime warning, confirmation, or obvious disclosure to the operator. In an agent-skill context this is dangerous because trust decisions are made on the reviewed package, but subsequent runs may execute materially different code obtained from the network.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The registration path silently writes local inventory state and transmits installation metadata as a best-effort side effect of ordinary operations, without any user-facing disclosure in this code path. Hidden telemetry is risky in agent environments because it can leak environmental and usage metadata beyond what users expect from a creative-generation skill.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 80% confidence
• Finding: This code persists a bearer access token in plaintext within ~/.beatra/credentials.json. Although the file is chmod'd to 0600 on POSIX, plaintext long-lived tokens remain recoverable by local malware, backups, or other processes running as the same user, and this skill requests broad scopes including wallet spending and media/task access, increasing the blast radius of token theft.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 92% confidence
• Finding: The skill includes built-in self-modification capability via its update command and auto-update path, allowing it to rewrite its installed code after initial review. In a marketplace/agent setting, self-modifying code is dangerous because it undermines static vetting and can introduce new behavior from the network after deployment.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.