Club Activity Talking Clips

• Outcome: Review
• Latest audit: Sep 6, 2026 · 9:18 AM UTC
• Version: 0.1.3

Overview

The skill is a disclosed Beatra talking-video client, but it grants broad shared account authority and silently self-updates code, so it belongs in Review before installation.

Install only if you are comfortable giving this package a shared Beatra device token with broad media, artifact, task, voice, and spending capabilities. Review the Beatra account approval page carefully, disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if unattended code replacement is not acceptable, and avoid using it on machines where hostname or installed-skill paths are sensitive.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969
• Finding: Silent Automatic Updates Permit Post-Review Remote Code Replacement<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mcp_client.py:969-1018`, `scripts/mcp_client.py:1517-1544`; documented in `SKILL.md:225-241` and `references/automatic-updates-and-safety.md:3-19` **Vulnerability Type**: Default-enabled remote payload retrieval and package replacement **Risk Level**: High ### Vulnerable Code ```python def maybe_auto_update( *, state_dir: Path | None = None, install_root: Path | None = None, get_bytes: GetBytes = _default_get_bytes, now: float | None = None, ) -> bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_u ...[truncated 3067 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic installation by default. Checking for updates may remain automatic, but file replacement should require explicit user confirmation. 2. Sign release manifests with a dedicated offline release key. 3. Embed only the verification public key in the reviewed client and reject unsigned, invalidly signed, expired, or wrong-package manifests. 4. Ensure the signed data covers the package name, channel, locale, version, complete file list, permissions, file hashes, and archive hash. 5. Support key rotation through a separately authenticated mechanism rather than trusting keys supplied by the same discovery response. 6. Present the target version and release metadata before replacement. 7. Consider staging the new package separately and requiring the host platform to activate it only after verification or review. 8. Preserve the existing path, archive, downgrade, size, lock, rollback, and package-ownership protections. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:33
• Finding: Authorization Requests Capabilities Beyond the Declared Talking-Clip Workflow<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:33-36`; unrestricted dispatch in `scripts/mcp_client.py:1458-1475` and `scripts/mcp_client.py:1484-1486` **Vulnerability Type**: Excessive OAuth scope combined with unrestricted MCP tool dispatch **Risk Level**: High ### Vulnerable Code The authorization helper requests the following complete scope: ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` The generic command accepts any tool name and forwards it to the server: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The declared functionality requires media upload, model discovery, speech synthesis, optional voice cloning, image-to-video generation, task reads, limited task cancellation, and wallet reads needed to report balance or charges. The requested token additionally includes broad capabilities such as `images:generate`, `music:generate`, `wallet:spend`, and the generic `mcp:tools` capability. Image and music generation are no ...[truncated 1857 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define a package-specific OAuth scope containing only the capabilities required by this workflow. 2. Remove image generation and music generation permissions unless a documented feature requires them. 3. Separate read-only wallet access from wallet spending where the service supports that distinction. 4. Add a local allowlist for the exact documented tools, including: - `beatra.assets.upload` - `beatra.models.list` - `beatra.voices.list` - `beatra.voices.clone` - `beatra.speech.synthesize` - `beatra.videos.animate` - `beatra.tasks.get` - `beatra.tasks.list` - `beatra.tasks.cancel` - documented read-only wallet calls 5. Reject all other tool names before creating a network request. 6. Apply separate code-level confirmation gates to billable operations, cloning, and cancellation rather than relying exclusively on natural-language instructions. 7. Avoid sharing a full-scope token across unrelated packages. Prefer per-package credentials or server-enforced package capability restrictions. 8. Log non-sensitive audit metadata for billable calls without logging bearer tokens, private prompts, or user media. ]]>

other

Note

• Location: scripts/authorize.py:343
• Finding: Authorization Collects and Transmits Hostname and Agent-Environment Identifiers<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:343-369`, `scripts/authorize.py:428-441`, `scripts/authorize.py:578-583`; related source attribution in `scripts/mcp_client.py:1139-1165` and `scripts/mcp_client.py:1214-1232` **Vulnerability Type**: Unnecessary device fingerprinting and installation telemetry **Risk Level**: Low ### Vulnerable Code The helper inspects environment signatures: ```python def detect_host_platform(explicit: str | None = None) -> str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" ``` It also retrieves the local hostname: ```python def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The resulting hostname and platform are added to the remote authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_referenc ...[truncated 2171 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not collect or transmit the hostname by default. 2. Use a locally generated, non-descriptive device label when a console device identifier is necessary. 3. Make hostname disclosure an explicit opt-in choice and show the exact value before transmission. 4. Minimize platform telemetry to a coarse category, or use `unknown` unless the user opts in. 5. Clearly document every metadata field transmitted during device authorization, its purpose, retention period, and deletion mechanism. 6. Allow telemetry to be disabled without preventing authentication or creative operations. 7. Rotate or delete the stable installation reference when the user disconnects the installation. 8. Avoid collecting IP addresses, FQDNs, interface details, or additional environment data in future versions unless strictly necessary and explicitly authorized. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:1044
• Finding: Windows Bearer-Token Privacy Relies on Unverified Inherited ACLs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:119-131`; credential read behavior in `scripts/mcp_client.py:1044-1052`; conflicting security guarantee in `references/installation-and-auth.md:14-21` **Vulnerability Type**: Missing Windows credential ACL creation and validation **Risk Level**: Medium ### Vulnerable Code The authorization helper applies explicit restrictions only on POSIX: ```python def _private_directory(path: Path) -> None: # POSIX gets explicit 700/600. On Windows the state directory lives under # the user profile, whose default ACL is already private to the user — # the same posture as gh/aws/gcloud credential stores. The former custom # DACL ceremony was dropped deliberately: its command patterns read as # hostile to agent safety policies and endpoint security, failing installs # while adding no protection an elevated administrator could not bypass. path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` The MCP client reads Windows credentials without inspecting the file ACL: ```python def _read_private_credentials(state_dir: Path, path: Path) -> str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` ### Technical Analysis The credential file contains a bearer token with generation, artifact, task, cancellation, and wallet-spending permissions. On POSIX, the code verifies directory ownership and mode ...[truncated 1754 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create `~/.beatra` and `credentials.json` with an explicit Windows ACL granting access only to the owning user and required system principals. 2. Disable unsafe inherited access entries where practical. 3. Before reading the token, verify: - The path is a regular file or an equivalent safe Windows file type. - The owner is the expected current user. - No unexpected users or broad groups have read or write access. - The path is not a reparse point leading outside the expected state directory. 4. Fail closed and require reauthorization or ACL repair when privacy cannot be established. 5. Use Windows-native security APIs through a small reviewed implementation rather than invoking shell utilities. 6. Consider storing the bearer token in Windows Credential Manager or another operating-system-backed secret store. 7. Keep the existing POSIX ownership, mode, regular-file, and no-follow validations. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill directs use of shell execution, network access, local file inspection/upload, and package updates, yet declares no permissions. That under-discloses its real capabilities and prevents meaningful user consent or policy enforcement, especially because it can read local files, send them to a remote service, and modify package-owned files via the updater.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The public description says the skill makes talking clips, but the body also enables browser/device auth, credential storage under ~/.beatra, arbitrary MCP tool invocation, remote file upload, telemetry/registration, uninstall state deletion, and self-update installation. This mismatch is dangerous because users may authorize a seemingly simple media skill without realizing it can persist credentials, transmit local data, and change local software state.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The OAuth scope request is far broader than the skill’s stated purpose of generating talking clips from user scripts and stills. Requesting wallet spending, task control, artifact read/write, music generation, and voice write permissions violates least privilege and means a compromised or misused skill could access or spend account capabilities unrelated to club notices.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code fingerprints the host environment and captures a recognizable device hostname during authorization even though that metadata is not necessary to turn photos and scripts into clips. This creates avoidable device-identifying telemetry that can aid tracking, inventorying agent platforms, or correlating installations across contexts.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill persists a local inventory of installed skills and their absolute installation paths, which exceeds the declared media-generation function. Recording this inventory creates unnecessary local surveillance of user environment details and can expose filesystem layout and installed tooling if the state directory is later accessed by other software or an attacker.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The client includes a built-in package update channel that downloads archives from remote infrastructure and later replaces files in its own installation directory. For a skill whose stated purpose is generating talking club-activity clips, self-modifying installer behavior is out of scope and materially increases supply-chain risk: any compromise of the update service, signing/checksum process, or distribution pipeline turns this media skill into a remote code deployment mechanism.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill records a local inventory of installed skills and sends installation registration telemetry, including package/version/platform metadata, even though that behavior is unrelated to creating talking clips from user media. This expands data collection and creates unnecessary observability about local environment state, which is especially concerning because it is performed automatically on normal use paths and not clearly tied to user-requested functionality.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the execution environment by inspecting agent-related environment variables and host metadata, then attaches platform attribution to tool calls and registration data. For a club notice talking-clip skill, this exceeds what is needed for image/video generation and increases privacy and tracking risk by enabling backend correlation of where and how the skill is used.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This code performs OAuth/device-token revocation against a shared Beatra account connection during uninstall, even though the skill’s declared purpose is club-video generation. Because the state is explicitly shared across skills, this uninstall path can affect other installed skills and reaches beyond the narrow media-creation scope users would expect from this package.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The uninstall routine deletes files in ~/.beatra including credentials, inventory, host, and registration state, which are shared application state rather than assets specific to this club-notice skill. Even with guard logic, embedding deletion of shared state inside a content-generation skill creates an unnecessary capability that could disconnect the user or interfere with other skills if assumptions are wrong or state is tampered with.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The script reads a device access token from credentials.json and uses it to make a network revocation request, a privileged credential-management action unrelated to generating talking clips. In the context of this skill, that capability is overprivileged and increases risk because a package expected to process media should not also be able to disable the user’s shared authorization.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that the bundled client silently checks for and automatically installs newer releases without separate confirmation. Silent self-update materially changes local code after initial trust, creating a supply-chain and integrity risk if the update channel is compromised or if users were not clearly informed that the skill can modify installed software.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The document states that the client silently checks for and automatically installs updates without separate confirmation, which changes local software state before ordinary user-requested work. Even though the text describes integrity checks and rollback protections, the lack of an explicit warning and opt-in/consent at the point of modification creates a real security and trust risk because users may not expect executable/package files to be replaced automatically.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The client performs best-effort silent automatic updates during ordinary command execution and may modify installed package files without a contemporaneous user-facing prompt. In the context of a content-generation skill, this is dangerous because routine use can unexpectedly change executable code, broadening the blast radius of a supply-chain compromise and undermining operator awareness and change control.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 82% confidence
• Finding: Referencing credentials.json in the set of files to delete indicates the skill is designed to interact with shared credential material during uninstall. In this skill context, access to credential storage is not necessary for video creation and broadens the package’s authority over sensitive authentication state.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 90% confidence
• Finding: This function opens ~/.beatra/credentials.json and extracts an access token for later use in revocation. Reading live authentication tokens from disk is sensitive credential access, and for a club-video generation skill it is unjustified and dangerous because compromise or misuse of the skill grants control over shared account authorization.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The exposed self-update capability enables the skill package to replace its own installed files, creating an explicit self-modification path. In a skill intended for talking-video generation, that capability is disproportionate to function and dangerous because it turns a media workflow component into a code-changing agent, amplifying any compromise of the remote update source or local execution path.

Static analysis

No suspicious patterns detected.