bilibili-video-storyboard

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:25 AM UTC
• Version: 0.1.4

Overview

This appears to be a legitimate Beatra storyboard tool, but it uses broad persistent account access and default silent self-updates that users should review before installing.

Install only if you trust Beatra with a persistent shared token that can spend credits and access broader generation tools than this storyboard workflow needs. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off` if you need reviewed-code stability, and revoke the device from the Beatra Console when you no longer use it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes shell, network, file read/write, and environment-dependent operations through a bundled Python client, yet no permissions are declared to inform or constrain the host. That mismatch is dangerous because it hides a materially broader trust boundary than a user would expect from a storyboard-planning skill, including remote calls, local state changes, and file upload behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is storyboard generation, but the skill also performs OAuth authorization, persistent credential storage, file upload, installation registration, telemetry-like registration flows, self-update, and uninstall-side token revocation/state deletion. This is a significant description-behavior mismatch that can mislead users and reviewers into granting trust to a creative tool that actually behaves like an installable networked client with account and system lifecycle operations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill documentation explicitly includes automatic package update and replacement behavior unrelated to the core storyboard function. Any self-modifying or self-replacing mechanism increases supply-chain risk, can change reviewed behavior after installation, and weakens the assurance that the analyzed skill is the same code that will run later.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: A network-based self-update channel is not necessary for generating storyboards and key frames, so it expands the attack surface without clear functional justification. Even with claims of fixed paths and verification, the mechanism introduces ongoing remote code/content trust and can be abused via supply-chain compromise or implementation flaws.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill requests a very broad OAuth scope set that materially exceeds its stated purpose of creating Bilibili storyboards. In particular, the scope bundle includes artifact, image, video, music, speech, voice, wallet, and task permissions, creating unnecessary privilege and increasing blast radius if the token is abused or the service is compromised.

Context-Inappropriate Capability

Critical

• Confidence: 93% confidence
• Finding: The authorization scope includes "music:generate", which is not justified by the stated storyboard-maker functionality. While less severe than spending or voice-management access, it still violates least privilege and permits unwanted generation actions or account consumption beyond the advertised feature set.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The authorization scope includes "music:generate", which is not justified by the stated storyboard-maker functionality. While less severe than spending or voice-management access, it still violates least privilege and permits unwanted generation actions or account consumption beyond the advertised feature set.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The authorization scope includes "music:generate", which is not justified by the stated storyboard-maker functionality. While less severe than spending or voice-management access, it still violates least privilege and permits unwanted generation actions or account consumption beyond the advertised feature set.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The client contains a substantial self-update subsystem that downloads manifests and archives from the network and replaces local package files, functionality unrelated to making Bilibili storyboards. Even though it includes integrity and path-safety checks, bundling broad local-installation mutation into a creative skill expands the trust boundary and creates a software supply-chain and persistence risk if the vendor infrastructure or signing/checksum distribution is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill records local inventory data and sends installation registration telemetry that is not described by the storyboard-generation purpose. This creates undisclosed data collection and local state mutation, increasing privacy and tracking risk, especially when tied to installation references and host platform data.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the execution environment using environment variables and a persisted host.json value to classify the host platform. For a storyboard-generation skill, this capability is not obviously necessary and increases privacy risk and the ability to tailor behavior by agent environment, which is more suspicious in a client already performing telemetry and self-update.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document states that the client silently checks for and automatically installs newer releases by default without separate confirmation. Even with integrity checks and rollback protections, default silent modification of local code can undermine user consent, surprise operators, and increase supply-chain risk if the trusted update source or signing pipeline is ever compromised.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The document describes an automatic installation registration call that transmits package and environment metadata, but it does not provide a clear user-facing notice or consent mechanism. Even if the data is described as non-secret and non-billable, silent telemetry can create privacy and transparency issues, especially because it includes platform and a stable external installation reference that may enable tracking across uses.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code detects and transmits host metadata such as platform and device name during authorization, and also persists local inventory/config files, without presenting explicit consent or a clear notice at the point of collection. Although the metadata is not highly sensitive by itself, it can aid device fingerprinting and exceeds what users may expect from a storyboard skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs silent automatic self-updates on normal command execution paths, modifying installed files without a contemporaneous user prompt or warning. In the context of an AI skill, hidden code replacement materially increases supply-chain risk and undermines user expectations about what code is running.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Best-effort telemetry and inventory recording occur automatically and are designed not to block the main operation, which also means they may happen without clear user awareness. For a storyboard tool, undisclosed background registration and local inventory persistence are unjustified and create privacy and trust concerns.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The exposed self-update command enables the package to replace its own installed code, which is a self-modification capability unnecessary for a storyboard-generation skill. Even with integrity checks, self-modifying application logic materially raises the risk of persistence and supply-chain compromise, because the running tool can alter future behavior outside the user's immediate task context.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.