beatra-ai-voice-studio

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:19 AM UTC
• Version: 0.2.5

Overview

This is a coherent Beatra voice-generation skill, but it uses broad account authority, stores a bearer token locally, sends installation metadata, and silently updates installed code by default.

Review this before installing. It appears designed for legitimate Beatra voice workflows and has meaningful consent, billing, and retry safeguards, but installation grants a broad shared Beatra token, stores it locally, registers installation metadata, and allows silent code updates by default. Install only if you trust Beatra's account, CDN, and update channel; consider disabling auto-updates with the documented command after installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exposes substantial capabilities (environment access, local file read/write, shell, and network) without declaring permissions, which prevents meaningful user or platform review of what the skill can do. In this specific context, those capabilities are enough to support credential handling, uploads, package modification, and remote command mediation, so the omission materially increases the chance of unsafe execution without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is a voice-generation workflow, but the skill also performs authentication, credential storage, uploads, installation registration, uninstall actions, and automatic package replacement. This mismatch is dangerous because users and reviewers may approve a benign-seeming media skill while unknowingly granting it lifecycle-management and persistence capabilities that expand the attack surface far beyond text-to-speech.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill claims it only coordinates voice-generation tasks, yet it also includes a self-update mechanism that downloads and replaces local package files. Even with claimed verification checks, self-modifying behavior is a materially different trust boundary: compromise of the update channel, packaging, or client logic could turn a voice skill into a code-delivery mechanism.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Automatic package update and local file replacement are context-inappropriate for a voice-generation skill because they grant software-management powers unrelated to the primary user task. That increases risk by normalizing privileged filesystem changes during routine content-generation operations, making abuse or accidental damage harder to detect.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The authorization flow collects and persists host metadata such as detected agent platform, device hostname, and local install path into host.json and skills.json. While this is not code-execution dangerous by itself, it exceeds the narrow need of obtaining an OAuth device token for voice generation and creates unnecessary local inventory data that can aid profiling or expose sensitive environment details if the state directory is later accessed by another process.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The client includes a built-in package self-update mechanism that downloads manifests and archives from the network and then overwrites local installation files. Even though there are integrity checks and path-safety controls, this materially expands the skill from voice-generation functionality into code deployment and self-modification, increasing supply-chain risk if the vendor infrastructure, signing workflow, or release pipeline is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill records local installation inventory and sends registration telemetry including package slug, version, platform, and an installation reference to the remote service. That behavior is not necessary for core voice-studio operations and creates privacy and tracking risk, especially because it runs as best-effort background behavior rather than a clearly disclosed, user-initiated action.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The code fingerprints the host environment by inspecting environment variables and local host metadata to classify the agent platform. For a voice-generation skill, this collection is not obviously required and increases privacy exposure and environment awareness that could be abused for user tracking or platform-specific behavior.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Treating broad phrases like "generate" or "make it" as sufficient approval is unsafe because those phrases may be ambiguous, especially in multi-step or billable workflows involving cloning, uploads, or repeated synthesis. In this skill, that ambiguity can trigger paid operations or sensitive voice-cloning actions without a clearly scoped confirmation tied to the exact request parameters.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill describes silent automatic software updates that modify local files without a prominent warning at the point of ordinary use. Silent modification is dangerous because users interacting with a voice tool would not reasonably expect background package changes, reducing transparency and hindering informed consent, incident response, and forensic review if something goes wrong.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The manifest prominently advertises voice cloning and reusable brand voices but includes no indication of consent, authorization, or privacy safeguards for biometric voice data. In a voice-generation skill, omission of these guardrails increases the risk of impersonation, unauthorized cloning, and mishandling of sensitive personal data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly describes silent, enabled-by-default automatic updates that install new code and replace package files without separate user confirmation. Even with integrity checks and rollback, this behavior materially changes the local installation and creates a supply-chain and trust-boundary risk if the update source, signing/checking logic, or distribution pipeline is ever compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: maybe_auto_update() performs a silent background update path that fetches remote package data and applies file replacements without a user-facing prompt in the execution path. In the context of a voice-studio skill, silent code replacement is especially risky because users invoking media features would not reasonably expect background modification of installed executable code.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The installation registration path transmits local installation metadata to the backend as best-effort telemetry, and this occurs automatically during normal session setup rather than through a dedicated consent flow. That creates an undisclosed data-sharing behavior unrelated to the user's immediate voice-generation request.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 86% confidence
• Finding: The script stores a long-lived bearer access token in plaintext JSON under ~/.beatra/credentials.json. Even with 0600 permissions, any local malware, compromised same-user process, backup leakage, or accidental file exposure would allow reuse of the token for broad API capabilities, and the requested scope includes powerful actions such as wallet spending and artifact access.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 93% confidence
• Finding: The exposed update command explicitly supports self-update behavior, meaning the package can modify its own installed files on disk. Self-modification significantly raises the blast radius of any upstream compromise or logic flaw and is outside the normal expectations for a voiceover-generation skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.