brand-jingle-studio

• Outcome: Review
• Latest audit: Aug 24, 2026 · 2:13 PM UTC
• Version: 0.1.1

Overview

This jingle skill has a real creative workflow, but it also stores a broad Beatra bearer credential and silently self-updates local package files by default.

Review before installing. This skill may be reasonable if you trust Beatra and want its hosted paid media tools, but installation grants a persistent shared Beatra token that can spend credits and access more than music generation, and the package auto-updates itself by default. Consider disabling auto-updates with the documented command and revoke the Beatra device authorization from the Beatra Console when you no longer need it.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares itself as a jingle generator, but the instructions authorize shell execution, filesystem access, network use, credential handling, and package mutation without declaring permissions. That hidden capability expansion breaks least-privilege expectations and can expose users to unauthorized code execution, data access, or remote communications under a misleadingly simple music-creation label.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: a content-generation skill also performs OAuth flows, stores credentials, uploads local files, calls remote tools, registers installations, self-updates, and supports uninstall cleanup. Users invoking a music skill would not reasonably expect privileged system/network behavior, making deception and abuse much easier if the surrounding package or backend is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill includes a self-updating mechanism that downloads and replaces local package files, which is unrelated to the user-visible task of generating jingles. Even with integrity claims, silent code replacement increases supply-chain risk and creates a path for persistent compromise if the update channel, signing process, or embedded trust roots are ever subverted.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest presents a harmless creative tool, but the documentation explicitly permits silent code download and replacement during ordinary command execution. That discrepancy undermines informed consent and materially raises the danger because users are more likely to run the skill in trusted contexts without recognizing it can mutate its own codebase.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The OAuth scope requests capabilities far beyond what a brand-jingle generator should need, including wallet spending, task control, image/video generation, artifact read/write, and voice management. Overbroad scopes violate least privilege and materially increase blast radius if the token is abused, leaked, or the backend is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code fingerprints the host agent platform from environment variables and captures a recognizable device hostname, then persists that data locally for later use. This is unrelated to the advertised jingle-generation purpose and creates unnecessary collection of environmental metadata that can aid tracking, profiling, or targeting if later transmitted or exposed.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill records a local inventory of installed skills and their resolved filesystem paths in a shared state file. This exceeds the needs of a jingle generator and can expose sensitive local environment details, including software inventory and install locations, which may assist lateral discovery or privacy-invasive profiling.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The client contains a full self-update mechanism that downloads manifests and archives, validates them, and replaces local package files, which is far beyond the stated jingle-generation purpose. Even with integrity checks and path validation, this introduces a software supply-chain and self-modification capability into a creative skill, increasing the blast radius if the update channel, signing process, or upstream infrastructure is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code records installation telemetry and maintains a local skills inventory unrelated to generating jingles, without any indication in the skill description that such tracking occurs. This creates undisclosed metadata collection about installed packages, platform, and install paths, which can aid profiling and inventorying of the user's environment.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The host platform detection logic fingerprints the execution environment using environment variables and persisted host metadata, then transmits that platform value in business and registration calls. For a jingle-generation skill, this capability is not functionally necessary and increases privacy risk by exposing agent/runtime identity and enabling environment profiling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Automatic package updates that replace files are described in the body but not prominently warned in the skill description users see up front. That lack of notice weakens informed consent and increases the chance that users invoke or install a self-modifying package under false assumptions about its risk profile.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer releases by default without separate confirmation. Even though it describes integrity checks and rollback protections, silent self-update with file replacement materially changes the user's installation and expands the trusted computing base, creating supply-chain and consent risks if the update channel, signing process, or upstream infrastructure is ever compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client performs silent automatic update checks and package replacement in the background before normal commands, suppressing exceptions and avoiding user-facing disclosure at execution time. Hidden network activity plus local file modification is risky in a skill context because users may not expect the tool to fetch and replace code during routine creative operations.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 90% confidence
• Finding: The code persists a long-lived bearer access token with the very broad granted scope set into a local credentials file. While storing tokens is normal for auth flows, doing so for a brand-jingle skill with excessive privileges creates a high-value local secret whose compromise could enable unrelated account actions such as spending, artifact access, or task manipulation.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The exposed self-update command advertises and enables self-modification of the local installed package. In the context of a brand-jingle skill, embedding code replacement capability is unnecessarily dangerous because it expands the skill from content generation into software maintenance and provides a path for upstream compromise to alter local executable code.

Static analysis

No suspicious patterns detected.