Beatra AI Video Studio

• Outcome: Review
• Latest audit: Aug 21, 2026 · 6:53 AM UTC
• Version: 1.2.4

Overview

This video-generation skill is mostly coherent, but it asks for broad persistent account authority and silently self-updates installed package files during normal use.

Install only if you are comfortable giving this package a persistent Beatra account token with broad generation and spending scopes, letting it upload selected local media to Beatra, sending installation/platform registration metadata, and allowing silent package updates by default. Consider disabling auto-updates with the documented command and reviewing Beatra account authorization/revocation controls before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while explicitly instructing use of shell commands, local file access, networked uploads, and a bundled client that can read/write local package state. That mismatch weakens user consent and sandbox expectations, making it easier for a user or host to invoke powerful capabilities without clear disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is video planning/creation, but the skill also performs credentialed remote tool access, local uploads, installation registration, uninstall cleanup, and package self-update. This broader behavior substantially expands the attack surface and trust boundary beyond what a user would reasonably infer from the description, increasing the risk of unintended code execution, data exfiltration, or persistence changes.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill includes automatic package self-update during normal command execution, which modifies local installed files in a workflow ostensibly about video generation. Any self-updating mechanism increases supply-chain risk; if the update channel, signing, or ownership assumptions fail, an attacker could introduce malicious code that runs under the skill's existing file, shell, and network privileges.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script requests a very broad OAuth scope set including wallet spending, music/speech generation, voice read/write, and task/artifact operations that are not necessary for a video studio skill as described. Over-scoped credentials violate least privilege and materially increase blast radius if the token is abused, leaked, or reused by other local components sharing the same credential store.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The authorization flow provisions and persists a shared Beatra bearer token with account capabilities broader than the skill description justifies, then reuses it as the default credential for future operations. In this skill context, that is especially dangerous because the package is presented as a video-creation tool, so users are unlikely to expect wallet spending and voice-management permissions, creating a privilege-surprise and account-abuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The client contains a full self-update mechanism that downloads manifests and archives from remote infrastructure and replaces local installation files. Even though it includes checksum and path validation, this behavior materially exceeds the stated video-generation function and creates a remote code modification channel inside the agent environment.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill records installation telemetry and a persistent local skill inventory unrelated to core video creation. This expands local tracking and outbound metadata disclosure, increasing privacy and surveillance risk without being necessary to fulfill the advertised task.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code fingerprints the host environment using environment variables and local state to derive a platform identifier, then attaches that data to business calls and telemetry. In a video-creation skill this is unnecessary capability expansion that can aid user/environment tracking and targeted behavior based on runtime context.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The client persistently stores a local inventory of installed skills and installation paths, which is unrelated to generating or editing videos. This creates a durable record of user tooling that can expose behavioral or environmental information and broadens the skill's access to local state.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The markdown states that newer releases install automatically without separate confirmation, but this is not presented as a prominent warning tied to normal use. Silent modification of package files undermines informed consent and makes it harder for users and hosts to distinguish expected behavior from compromise, especially in a skill that already uses shell, network, and local file operations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer releases without separate confirmation. Even though it describes integrity checks and rollback protections, silent self-updating that replaces local package files is still a security-relevant behavior because it modifies the user's system without an explicit just-in-time prompt and increases supply-chain risk if the trusted update infrastructure or signing/checking process is ever compromised.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document describes an automatic network call on first use that sends package slug, version, platform, and a stable external installation reference, but it does not mention any explicit user notice, consent, or opt-out. Even if described as non-billable and non-secret, this is still telemetry-like installation tracking that can disclose environment and persistent installation metadata without the user's informed approval.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs silent automatic updates that can download content from the network and overwrite local installation files during normal command execution without a user-facing warning at that moment. This is dangerous because it changes executable behavior out of band, reducing user control and increasing supply-chain risk if the update channel or publisher is ever compromised.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: Self-modification capability is present through the update command and related update pipeline, allowing the skill package to replace its own local files. In an agent skill, self-modification is high risk because it can alter future behavior and trust boundaries after installation, especially when triggered from routine execution paths.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.