Beatra

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:00 AM UTC
• Version: 2.7.8

Overview

Beatra’s media features are mostly coherent, but it should be reviewed because it can silently replace its own installed files and automatically register a stable installation identity.

Install only if you are comfortable giving Beatra a shared device authorization stored in ~/.beatra, allowing local media uploads you request, spending Beatra credits for approved work, sending limited installation registration metadata, and accepting silent package self-updates by default. In stricter environments, disable automatic updates with python3 scripts/mcp_client.py update --auto off and revoke the Beatra device from the Beatra Console when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exercises powerful capabilities including shell, network, filesystem access, and environment usage, but does not declare them up front. That creates a transparency and consent failure: users may invoke what appears to be a media-generation skill without understanding it can authorize accounts, store tokens, upload local files, and modify package-owned files via updates.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents the skill as a creative/media tool, but the body also includes device authorization, credential storage, installation registration/telemetry, uninstall cleanup, and automatic package update/replacement behavior. This mismatch is dangerous because it obscures security-relevant behaviors from users and hosts, reducing informed consent and making privilege abuse or unexpected persistence more likely.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The client implements package self-update and can replace local installation files, which materially exceeds a simple media/MCP client role and creates a code-execution trust path from remote infrastructure into the local environment. Although the update flow includes integrity checks, automatic code replacement increases supply-chain risk: compromise of the vendor's discovery/manifest/signing pipeline or CDN origin would directly modify executable local code.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The code records a local skills inventory and sends installation telemetry that is not evident from the stated creative/media function. Even if best-effort, this expands data collection about installed tools, host platform, and installation identity, creating privacy and enterprise asset-discovery concerns if users were not clearly informed.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill uses broad, permissive invocation language such as reusing conversation context and inferring details, without tight trigger boundaries. In a skill that can spend credits, upload media, query public social data, and manage persistent state, broad activation semantics increase the risk of overreach or unintended tool execution from ambiguous user requests.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill describes silent automatic update checks and the possibility of downloading and replacing package-owned files, but this is not prominently disclosed in the upfront description. Self-update plus file replacement materially changes the trust boundary, because future code may run with the same privileges without a clear new consent moment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that the client performs silent update checks by default and automatically installs newer versions without separate confirmation. Even with integrity checks and fixed update sources, silently modifying a local installation changes executable behavior without an explicit user approval step, creating supply-chain and trust risks if the update channel is ever compromised or if users are unaware auto-modification is enabled.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly describes an automatic network registration on first use that sends package slug, version, platform, and a stable external installation reference, but it does not provide a clear user-facing warning or consent model for this telemetry-like behavior. Even if described as non-billable and non-secret, silent transmission of persistent installation metadata can surprise users, create privacy concerns, and undermine informed consent, especially in security-sensitive or enterprise environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: maybe_auto_update() performs silent automatic updates and local file replacement during normal command execution without a contemporaneous user-facing warning. In a skill context, hidden modification of executable package contents is dangerous because users invoking media actions may unknowingly run newly downloaded code, amplifying supply-chain and policy-bypass risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: "beatra"
description: "Create AI images, videos, music, and voice, look up public social data, edit visual results, and keep generated assets easy to find and manage. Beatra Universal turns text into images, images and references into video, ideas into songs or instrumentals, and scripts into narration, while also supporting custom voice creation and public social media data lookup across YouTube, TikTok, Instagram, and X. Use it as an AI media generator and AI creative suite for text-to-image, image-to-video, AI video editing, AI music generation, text-to-speech, multilingual voice-over, voice cloning, multimodal content creation, and YouTube or TikTok data for posts, comments, accounts, and trends. Reuse source media, returned files, and public social findings across formats, follow production progress, and view actual credit use for completed creative work."
---

# Beatra Universal

• Confidence: 76% confidence
• Finding: The skill explicitly reuses source media, returned files, public social findings, task progress, and credit information across interactions, indicating session persistence and cross-task state reuse. While functional for media workflows, persistence increases the blast radius of mistakes or abuse because prior artifacts, identifiers, and user context can be carried into later actions without renewed validation.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 92% confidence
• Finding: The package exposes self-update functionality that can modify its own installed code. Self-modification is inherently high risk in agent-integrated software because it changes future execution behavior and can serve as a remote code delivery mechanism if the update channel or vendor infrastructure is compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.