Beatra AI Image Studio

• Outcome: Review
• Latest audit: Aug 20, 2026 · 7:58 AM UTC
• Version: 1.1.3

Overview

This image skill is mostly coherent, but it grants and stores broad account authority and silently self-updates local package files by default.

Install only if you are comfortable giving this Beatra package a shared device token with broad media and spending authority, plus default silent package updates. Consider disabling auto-updates immediately with scripts/mcp_client.py update --auto off, using a dedicated Beatra account or low-balance credit setup, and revoking the device token from Beatra when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions while its documented behavior requires shell execution, file access, network access, environment use, and file modification via the bundled client and updater. This creates a capability-transparency gap: operators may authorize or run the skill believing it is limited to image generation when it can also upload local files, store credentials, call remote services, and replace package-owned files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is an image studio, but the skill also performs unrelated sensitive operations: OAuth/device auth, credential storage, arbitrary MCP remote tool invocation, telemetry/registration, uninstall cleanup, and automatic self-update with package replacement. That mismatch is dangerous because users and reviewers may trust the skill under a narrow image-editing mental model while it exercises broader system and network capabilities that increase attack surface and supply-chain risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill documentation includes automatic update and package replacement behavior that exceeds the core image-generation/editing purpose. Even with some verification claims, self-updating code materially changes the local execution boundary over time and introduces supply-chain exposure not implied by the skill’s primary function.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatic download and replacement of local files is not necessary for the stated image-studio purpose and expands the trusted computing base. Any flaw in update verification, package ownership checks, or distribution infrastructure could turn ordinary skill use into code execution or persistent compromise.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope requests capabilities far beyond the stated purpose of an image studio skill, including video, music, speech, voice management, task control, and wallet spending. Overbroad authorization violates least privilege and means any compromise or misuse of the stored bearer token would grant access to unrelated high-value APIs.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: The inclusion of `wallet:spend` is especially dangerous because it authorizes spending actions unrelated to image generation. If the credential is abused, an attacker or buggy downstream component could initiate financial transactions in the user's account, turning a creative tool into a direct monetary risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The client implements a full self-update mechanism that fetches manifests and archives from remote infrastructure and replaces local package files, behavior that exceeds the stated image-generation/editing purpose. Even with checksum and path validations, this materially expands the trust boundary: compromise of the vendor update channel, signing workflow, or distribution infrastructure would let remote code changes be introduced into the agent environment.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The client records local skill inventory and sends installation-registration telemetry unrelated to the core image-studio function. This creates unnecessary collection and transmission of device/package metadata, increasing privacy and supply-chain risk without being clearly justified by the declared skill behavior.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill inspects environment variables and host state to infer the surrounding agent platform for attribution/telemetry, which is beyond what is needed for image generation. In an agent context, platform fingerprinting can leak operational metadata about the host environment and make cross-system tracking easier.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill states that newer releases install without separate confirmation, but the description does not prominently warn users that local files may be modified during routine use. This undermines informed consent and makes social engineering or unexpected persistence more plausible, especially in environments that expect skills to be task-scoped rather than self-modifying.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document states that the client silently checks for and automatically installs newer releases by default without separate confirmation. Even though the text describes integrity checks and rollback protections, unattended self-updating that replaces local files increases supply-chain and change-management risk because users may be unaware that executable code is being modified during normal operation.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation states that first use triggers a network registration call and writes a local cache file, but it does not present this as an explicit warning or informed-consent notice to users. Hidden or insufficiently disclosed telemetry-like transmission and filesystem writes can undermine user trust, violate enterprise policy, and lead users to run the skill without understanding its side effects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Automatic silent self-update changes installed code during normal execution without a user-facing prompt at the point of action. In a security-sensitive agent environment, silent code replacement undermines administrator expectations and can convert any compromise of the upstream update path into unnoticed local code execution on subsequent runs.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The code sends installation registration telemetry as a best-effort background action without a clear user-facing notice in this execution path. While not directly enabling code execution, undisclosed telemetry weakens user consent and leaks metadata about installed packages and environment usage.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 92% confidence
• Finding: This code persists a bearer access token to `credentials.json` on disk, creating a local secret-at-rest exposure. Although the script applies restrictive permissions, the token is still stored in plaintext and carries highly sensitive scopes, so theft via local compromise, backups, logs, or misconfigured file sharing could lead to broad account misuse.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 94% confidence
• Finding: The exposed self-update capability is a form of self-modification: the skill can download and replace its own local code. In an agent skill whose declared purpose is image generation/editing, this is especially risky because it gives the package an independent mechanism to alter executable behavior outside normal platform governance and review.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.