bilibili-thumbnail-maker

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:23 AM UTC
• Version: 0.1.3

Overview

This thumbnail skill mostly matches its creative purpose, but it also installs a broad Beatra client with silent self-updates, wide account scopes, and registration telemetry that users should review first.

Install only if you are comfortable granting this Beatra package a shared device credential with broad media/task/artifact and spending-related authority. Review the automatic update setting first; running `python3 scripts/mcp_client.py update --auto off` disables silent update checks for this installation. Also be aware that first use registers package/version/platform data with Beatra and stores credential and registration state under ~/.beatra.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares itself as a thumbnail-creation workflow, but its documented operation requires broad capabilities including filesystem access, shell execution, environment access, and network communication without declaring those permissions up front. This undermines least-privilege expectations and makes it easier for users or hosts to authorize more access than is necessary for the advertised task.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented behavior materially exceeds the stated purpose: in addition to image creation, it performs authentication, credential storage, arbitrary remote MCP interactions, local file upload, telemetry/registration, uninstall cleanup, and software update/installation. That mismatch is dangerous because users may consent to a creative tool while unknowingly granting a general remote client with persistent credentials and local modification capability.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill includes a silent self-update path that can download and install newer client code during normal command execution, which is unrelated to the core thumbnail-making function. Even with verification claims, automatic code replacement expands the trust boundary and creates a supply-chain and local integrity risk if update channels, signing, ownership checks, or distribution infrastructure are compromised.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: A skill presented as a content-generation tool also documents automatic software installation and replacement of package-owned files, which is a materially different and higher-risk behavior. This is dangerous because it allows local state and executable code to change under the guise of a normal creative workflow, increasing the chance of unnoticed persistence or compromise.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This documentation describes a bundled client that silently checks for and installs software updates, which is unrelated to the stated purpose of a Bilibili thumbnail-generation skill. Introducing self-updating behavior into a content-generation skill expands the trust boundary and creates supply-chain and unauthorized file-modification risk, especially because it runs before ordinary commands by default.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file documents silent automatic installation of updates without separate confirmation, which is unjustified for a thumbnail-maker skill and can be abused to change local code outside the user's immediate intent. Even with integrity checks described, silent self-modification materially increases supply-chain risk because a compromised update source or flawed updater could alter installed files automatically.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation describes automatic outbound registration on first use that transmits package slug, version, platform, and a stable external installation reference. For a thumbnail-generation skill, this is undocumented telemetry-like behavior that expands data flow beyond the user’s creative task and creates privacy and trust risks even if the payload is described as non-secret and non-billable.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill persists registration metadata in `~/.beatra/registrations.json` and sends installation-related fields that are not necessary to generate Bilibili thumbnails. Collecting and caching installation metadata outside the stated purpose increases unnecessary data retention and can enable installation tracking across runs or environments.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The OAuth scope string requests a very broad set of capabilities far beyond a thumbnail-generation skill, including MCP tools access, artifact read/write, media generation across multiple modalities, task control, and wallet spending. This violates least-privilege and increases the blast radius if the skill, its state directory, or the issued token is abused, especially because the skill description only justifies image/thumbnail creation.

Context-Inappropriate Capability

Critical

• Confidence: 94% confidence
• Finding: The authorization request includes tasks:read, tasks:cancel, artifacts:read, and artifacts:write, which exceed what a simple thumbnail generator would normally need unless each is specifically justified. These scopes may expose other user workflows or permit interference with unrelated jobs, increasing lateral impact if the token is misused.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The authorization request includes tasks:read, tasks:cancel, artifacts:read, and artifacts:write, which exceed what a simple thumbnail generator would normally need unless each is specifically justified. These scopes may expose other user workflows or permit interference with unrelated jobs, increasing lateral impact if the token is misused.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The authorization request includes tasks:read, tasks:cancel, artifacts:read, and artifacts:write, which exceed what a simple thumbnail generator would normally need unless each is specifically justified. These scopes may expose other user workflows or permit interference with unrelated jobs, increasing lateral impact if the token is misused.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This thumbnail-making skill contains a substantial package management and self-update subsystem unrelated to the advertised purpose. Even though it includes integrity checks, it expands the attack surface by downloading, validating, and replacing local package files, which is a powerful capability that can change behavior after installation and exceeds user expectations for an image-generation helper.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill records local skill inventory and performs installation registration telemetry, including package slug, version, platform, install path, and external installation reference, despite this being unrelated to thumbnail creation. This creates unnecessary privacy and tracking exposure and increases the sensitivity of the client beyond its stated function.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The client fingerprints its host environment by inspecting agent-specific environment variables and persisted host metadata, then attaches that platform identifier to outbound tool calls and telemetry. For a thumbnail-maker skill, this capability is not necessary for core functionality and increases privacy risk while enabling environment profiling.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill states that a newer client may be installed automatically without separate confirmation, yet the main skill description does not clearly warn users that running it can modify local package files. Lack of explicit disclosure weakens informed consent and makes unexpected code changes more likely to be accepted in environments that treat the skill as a simple media-generation tool.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation normalizes silent installation behavior without clearly warning users that files on their system may be modified automatically. This weakens informed consent and can mislead users about operational risk, particularly in a skill whose expected function is generating thumbnails rather than managing local software installations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that the bundled client automatically performs installation registration on first use, but it does not present an explicit warning or consent flow for telemetry-like outbound communication. In the context of a media-creation skill, hidden first-run network activity is more suspicious because it is not obviously required for core functionality and may violate user expectations or organizational policy.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill can silently auto-update itself during normal execution and modify installed files without user-facing notice at runtime. Silent self-modification is dangerous because it allows future behavior changes outside the user's immediate awareness, and in the context of a creative thumbnail tool this is especially unjustified and increases trust and supply-chain risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The client sends installation registration telemetry in a best-effort background path without a clear user-facing warning at the time of execution. This is risky because it transmits persistent installation metadata from a tool whose described purpose is thumbnail generation, making the behavior unexpected and privacy-invasive.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The client explicitly supports self-update and contains code paths that download archives and replace files under its installation root. Self-modification is a high-risk capability because compromise of the update channel, logic flaws, or user confusion can alter the executable behavior of the skill over time, which is especially concerning for a thumbnail tool that should not need code-replacement features.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.