beatra-ai-music-creator

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:18 AM UTC
• Version: 1.3.5

Overview

This is a coherent music-generation skill, but it grants broad Beatra account access and can silently replace its own package files, so it needs review before installation.

Review this before installing. Beatra approval gives this package a shared full-scope device token that can be used for more than music, and ordinary commands may silently update the package unless automatic updates are turned off. Install only if you trust Beatra's account, billing, telemetry, and update infrastructure, and consider disabling auto-update with the documented command if you require manual review of code changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while explicitly directing use of a bundled Python client that performs shell execution, local file access, network calls, uploads, updates, and credential handling. This undermines user and platform transparency because the actual capability surface is significantly broader than the advertised one, increasing the chance of unintended code execution and data movement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is music generation, but the skill also includes OAuth authorization, persistent credential storage, generic remote tool invocation, local file upload, telemetry/registration, self-update, and uninstall logic. That mismatch is dangerous because users may authorize a creative skill without understanding it can persist secrets, reach arbitrary remote services through a generic client, modify local installation state, and update itself.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The document describes automatic outbound installation registration that transmits package and environment metadata, but this telemetry is not reflected in the skill's user-facing description. Hidden or insufficiently disclosed telemetry creates a trust and privacy issue because users may invoke a music-creation skill without realizing it phones home on first use and periodically thereafter.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Automatic installation registration is not obviously necessary for generating music, lyrics, or arrangements, so it introduces extra data collection outside the stated functional scope of the skill. Even if the transmitted fields are described as non-secret, collecting stable installation references and platform details can still enable tracking, inventorying, or correlation across environments.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The OAuth scope requests far exceed the stated purpose of a music-creation skill, including wallet spending, task control, image/video generation, and voice management. Overbroad scopes violate least privilege and materially increase blast radius if the credential is misused, stolen, or the service is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The script records a device-local cross-skill inventory in ~/.beatra/skills.json, including install paths and platform data, which is unrelated to core music generation. This creates unnecessary local tracking of other installed skills and expands privacy and reconnaissance value for any process that can read the state directory.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The client includes a full self-update and installation-management subsystem that can download manifests and archives from remote infrastructure and replace local package files. For a music-generation skill, this significantly expands the trust boundary and creates persistent code-modification capability unrelated to the user-facing purpose, increasing supply-chain and post-installation risk if the vendor infrastructure or update channel is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code records local skill inventory and performs installation telemetry to a remote service on normal use, even though that behavior is not necessary for creating music. This introduces unnecessary device profiling and persistence of local installation metadata, which can expose usage patterns and system context and is especially concerning because it is performed best-effort and largely silently.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer releases without separate confirmation. Even though it describes integrity checks and fixed update sources, default silent self-update with file replacement materially changes local code and behavior without explicit per-update user consent, increasing supply-chain and trust-boundary risk if the vendor channel, signing/checksum process, or distribution pipeline is ever compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown states that the bundled client automatically makes an outbound registration call on first use, but it does not present an explicit warning or consent mechanism to the user before transmission. This is dangerous because silent network egress from a creative tool can violate user expectations, internal policy, or regulated environment requirements even when the payload is limited.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The maybe_auto_update() path performs silent automatic updates and can replace installation files without interactive confirmation or prominent notice. In the context of an agent skill, this is dangerous because it enables remote code changes to land during routine operations, turning any compromise of the update source or trust chain into persistent local code execution.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 94% confidence
• Finding: The exposed self-update capability allows the package to modify its own installed code on disk, which is a powerful persistence and code-substitution primitive. Even with some integrity checks, self-modifying updater logic inside a non-update-specific skill is risky because any failure in the update trust model can directly convert into execution of attacker-controlled code in future runs.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.