comment-voc-miner

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:30 AM UTC
• Version: 0.1.4

Overview

This skill is a disclosed comment-analysis workflow, but it installs a broadly privileged Beatra client with full-scope credentials, generic tool dispatch, and silent self-updates that go beyond the narrow task.

Install only if you are comfortable giving this package a shared, broad Beatra device token and allowing default silent updates of the package files. For lower risk, disable automatic updates with `python3 scripts/mcp_client.py update --auto off`, use pasted comments when possible, and approve paid lookups only after checking the platform, operation, and credit price shown by the agent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises a narrowly scoped comment-analysis workflow but exposes broad operational capabilities including environment access, file read/write, network access, and shell execution via the bundled client. Even if intended for legitimate tool use, this creates a much larger attack surface than users would reasonably expect and could enable credential access, local file modification, or arbitrary outbound requests if the client or referenced workflows are abused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is comment mining, but the skill also introduces authentication flows, local credential storage, generic tool invocation, asset upload, telemetry/registration, uninstall-side credential revocation, and self-updating code replacement. This mismatch is dangerous because users may approve or install the skill expecting passive text analysis while it actually gains persistent system and account-level behaviors far outside that scope.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill includes silent self-updating downloads and local installation replacement despite being presented as a comment-analysis workflow. Silent code replacement materially changes the trust model: future behavior can change without a fresh install review, enabling supply-chain compromise or unexpected new capabilities on the host.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Automatic code update and file replacement are not necessary to transform public comments into a brief, so this capability is disproportionate to the stated task. Unnecessary self-modifying behavior increases the chance of abuse or accidental breakage and weakens least-privilege expectations for a content-analysis skill.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope string requests far more capability than a comment-mining skill appears to need, including artifact access, media generation, voice management, task control, and wallet spending. If the issued token is later abused, compromised, or used by other package code, the excessive scopes expand the blast radius well beyond the advertised functionality and violate least-privilege expectations.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The requested tasks:read, tasks:cancel, artifacts:read, and artifacts:write scopes exceed what is apparent for a same-day comment-analysis workflow. If a token with these privileges is exposed or the package contains hidden behavior elsewhere, it could inspect, modify, or cancel unrelated user work products and jobs in the broader platform.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The requested tasks:read, tasks:cancel, artifacts:read, and artifacts:write scopes exceed what is apparent for a same-day comment-analysis workflow. If a token with these privileges is exposed or the package contains hidden behavior elsewhere, it could inspect, modify, or cancel unrelated user work products and jobs in the broader platform.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The requested tasks:read, tasks:cancel, artifacts:read, and artifacts:write scopes exceed what is apparent for a same-day comment-analysis workflow. If a token with these privileges is exposed or the package contains hidden behavior elsewhere, it could inspect, modify, or cancel unrelated user work products and jobs in the broader platform.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements a full self-update and package management system that can download, validate, and replace installed package files, which is materially broader than the declared comment-mining purpose. Even with integrity checks, this expands the trust boundary to remote package infrastructure and gives the skill ongoing code-modification capability on the host, making compromise or misuse significantly more damaging.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The client records local skill inventory and sends installation registration telemetry that is unrelated to comment analysis. This creates unnecessary collection and transmission of local environment metadata, increasing privacy and tracking risk without clear user benefit or alignment with the stated functionality.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The client fingerprints the host agent platform by inspecting environment variables and host state, which is not required for comment mining. This broadens telemetry and enables environment profiling that could be used for tracking, targeting behavior by host, or adapting future payloads to a specific agent environment.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The generic tool-dispatch entrypoint reads arbitrary JSON from stdin and can invoke any Beatra tool name, exceeding the advertised scope of a comment-mining skill. In context, this turns the package into a general remote tool broker rather than a narrowly scoped client, increasing the chance of unauthorized capability access or misuse through confused-deputy behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill text notes silent checks and automatic installation behavior deep in the document, but the top-level description does not clearly warn users that local package files may be modified by default. This weak disclosure is dangerous because users cannot give meaningful informed consent to a skill that can change itself after installation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The manifest explicitly configures a remote MCP endpoint over streamable HTTP with device-bearer authentication, yet provides no user-visible notice that using the skill will trigger credential-backed network requests to an external service. This can cause users to unknowingly send links, pasted comments, and potentially account-scoped request metadata to a third party, increasing privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document states that the client silently checks for updates by default and automatically installs newer releases without separate confirmation. Even with integrity checks and rollback protections, silently replacing local executable/package files changes system state without explicit user consent at the time of update, which can create trust, change-management, and supply-chain risk if the update channel is ever compromised or if the behavior is unexpected to the user.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: maybe_auto_update() performs silent package modification during normal execution without a contemporaneous user-facing warning. Although the update path includes validation, unattended code replacement in a skill unrelated to package management reduces user control and makes any upstream compromise or operational mistake more impactful.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The upload function reads a local file and sends its contents to a remote service after requesting an upload grant, but the code itself provides no privacy notice or strong contextual warning about exfiltration of local data. In a skill centered on public-comment analysis, local file transmission is a sensitive capability that may exceed user expectations if not prominently disclosed.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: Exposing self-update as a first-class CLI capability confirms the package is designed to modify its own installed code. In the context of a narrowly described comment-analysis skill, self-modification is a dangerous excess capability because it enables persistent code changes sourced from remote infrastructure and complicates trust, review, and containment.

Static analysis

No suspicious patterns detected.