Club Activity Talking Clips

• Outcome: Review
• Latest audit: Oct 12, 2026 · 10:51 AM UTC
• Version: 0.2.0

Overview

The skill's club talking-video workflow is coherent, but it also grants a broad shared Beatra authorization and silently self-updates package files by default.

Install only if you are comfortable granting this Beatra package a shared, persistent device authorization and allowing its bundled client to update package files automatically. Before use, consider running the documented update command to disable silent updates, and review whether the broad Beatra account scopes are acceptable for your environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The referenced uninstall/disconnect capabilities are unrelated to the advertised task of producing talking clips and imply authority to inspect and delete local state, use stored credentials, and alter shared connection state for other installed skills. Hidden administrative capabilities in a content-generation skill are a serious trust and safety issue because they enable destructive or account-affecting actions outside the user's expected workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The referenced uninstall/disconnect capabilities are unrelated to the advertised task of producing talking clips and imply authority to inspect and delete local state, use stored credentials, and alter shared connection state for other installed skills. Hidden administrative capabilities in a content-generation skill are a serious trust and safety issue because they enable destructive or account-affecting actions outside the user's expected workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The referenced uninstall/disconnect capabilities are unrelated to the advertised task of producing talking clips and imply authority to inspect and delete local state, use stored credentials, and alter shared connection state for other installed skills. Hidden administrative capabilities in a content-generation skill are a serious trust and safety issue because they enable destructive or account-affecting actions outside the user's expected workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This documentation describes a bundled client that silently self-updates from network locations before ordinary commands, which is unrelated to the stated purpose of a club-notice talking-video skill. A hidden or mismatched updater materially increases supply-chain and remote code execution risk because it enables file replacement behavior outside the user’s expected workflow and broadens the trust boundary far beyond media generation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Silent automatic update checks and installs are unjustified for a talking-video skill and create a dangerous path for unprompted background network access and local file replacement. Even with claimed verification controls, this behavior lets the package change itself without a contemporaneous user decision, making compromise, abuse, or policy evasion far more damaging.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 53)May include surrounding context.

json

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 53)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 12)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 430)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 1009)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1612)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 39)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The OAuth scope request is far broader than the skill's stated purpose of generating talking clips from scripts and stills. It asks for wallet spending, music generation, voice write, task control, and broad artifact access, so if the credential is approved or later abused, the skill gains capabilities unrelated to its declared workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The requested tasks and artifacts management scopes exceed what is clearly justified by the manifest's simple media-studio description. Broad read/write/cancel abilities can expose or manipulate unrelated user jobs and outputs if this shared credential is later misused.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The client contains broad non-core behaviors for a media-generation skill, including self-update logic, package file replacement, and persistent local state management. For a skill whose stated purpose is generating club talking clips, this materially enlarges the trusted computing base and creates unnecessary code paths that can modify the local installation if the remote update channel or client logic is ever abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill can automatically download, validate, and apply updates that rewrite files in its own installation path. Even with checksum and manifest checks, self-modifying code in a content-generation skill is high risk because compromise of the update pipeline or signing/discovery process would yield arbitrary code replacement on the host without the user's focused review at execution time.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The presence of a self-update command confirms that this skill is designed to modify its own installed code, which is unnecessary for the advertised clip-generation function and significantly increases risk. In this context, self-modification is more dangerous because users and host agents may grant trust for media generation, not for ongoing code deployment capabilities.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 2396)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This function reads an access token directly from a shared credentials file so the skill can revoke device authorization. Direct access to bearer tokens by a skill package is dangerous because any compromise or repurposing of the code could misuse the token, and the skill's declared video-generation purpose does not justify reading shared authentication material.

Content

Scanner excerpt · scripts/uninstall.py (reported line 121)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares no explicit tool scope or permission boundary even though it instructs use of shell, file access, network access, and environment-capable bundled tooling. That creates an unnecessary trust gap: a host may allow broader capabilities than users expect, and the skill can exercise sensitive operations such as uploads, credential handling, and update actions without a clear least-privilege declaration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that the bundled client can automatically install newer releases without separate confirmation, modifying package-owned files. Even with signature verification, silent self-update increases supply-chain and change-management risk because behavior can change after approval, and users may not realize the tool they trusted today can acquire new capabilities tomorrow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The changelog states that users in mainland China are routed through a specific mainland network and only alternatively may use an international sign-in page. This is a natural-language locale policy that varies behavior by region, but the manifest does not present it as an explicit user choice or clearly justify the restriction as a compliance requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Enabling silent update checks and replacement behavior by default without clear upfront warning deprives users of meaningful consent about background network activity and filesystem changes. In the context of an unrelated club-video skill, this is especially suspicious because users would not reasonably expect the tool to contact remote hosts and mutate its own installation during normal operation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 106)May include surrounding context.

md

- say prominently that a signed-out browser lands on Beatra sign-in first:
  the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
  ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
  in [MCP connection](mcp-connection.md#network-route).