course-narration-studio

• Outcome: Review
• Latest audit: Oct 21, 2026 · 3:44 AM UTC
• Version: 0.2.6

Overview

This narration skill requires broader account permissions than it needs, and an uninstall bug can disconnect other Beatra skills.

Review the broad Beatra authorization before installing: it permits spending credits on images, videos and music as well as narration. Prefer narration-limited access and a fix for the shared-connection uninstall bug. Expect documented installation analytics, and submit only course materials and voice recordings you are authorized to share. Device access can be revoked through the Beatra Console.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence

Findings (31)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The reported image, video, and music permissions exceed the narration workflow's needs; persisting a shared credential with those scopes increases the consequences of credential theft or unauthorized reuse. Spending capability itself is consistent with the explicitly documented paid synthesis and cloning, but unrelated generation privileges are not justified by that context. The underlying credential implementation was not provided, so this assessment relies on the static finding's description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The reported automatic transmission of a persistent installation identifier together with environment metadata creates a tracking and privacy risk unrelated to producing narration. Although installation registration is referenced, the supplied document does not explain this collection or establish informed consent; describing services as official does not resolve that concern. The reporting implementation and any disclosures in referenced files were not supplied, limiting verification.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 62)May include surrounding context.

json

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/updates-and-security.md (reported line 32)May include surrounding context.

md

These files are written under `~/.beatra/`. On POSIX that directory is mode
0700. Nothing is written inside the installed Skill directory.

- `credentials.json` (POSIX mode 0600), written by `scripts/authorize.py`: the device credential.
- `installation.json` (POSIX mode 0600), written by `scripts/authorize.py`: the stable installation reference.
- `host.json` (POSIX mode 0600), written by `scripts/authorize.py`: the agent environment, and a device name when one is known.
- `network.json` (POSIX mode 0600), written by `scripts/mcp_client.py`: this computer's network route.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/updates-and-security.md (reported line 56)May include surrounding context.

md

When `scripts/uninstall.py` decides this is the last Beatra skill on the
computer, it first asks Beatra to revoke the device credential when one is
stored. If Beatra refuses, it changes nothing so the run can be repeated.
Otherwise it unlinks exactly these names in `~/.beatra/`: `credentials.json`,
`installation.json`, `host.json`, `skills.json`, `registrations.json`,
`network.json`, `balance-holds.json`, `pending_authorization.json`, and
`.authorize.lock`. It also unlinks `state.json`, `registration.json`, and

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

md

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 53)May include surrounding context.

md

and keeps checking through brief network failures. One run waits up to
   about 15 minutes; an approval page stays open for up to an hour;
5. atomically saves the returned Device Token to
   `~/.beatra/credentials.json` without printing an HTTP response body;
6. validates the new credential with the same non-billable MCP request and
   prints `Beatra is ready` only after it succeeds.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 432)May include surrounding context.

python

def _existing_credential(state_dir: Path) -> Path | None:
    path = state_dir / "credentials.json"
    try:
        path_stat = os.lstat(path)
        if not stat.S_ISREG(path_stat.st_mode):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 1008)May include surrounding context.

python

scope = _required_string(polled, "scope")
    if set(scope.split()) != set(SCOPE.split()):
        raise RuntimeError("Beatra authorization returned an unsupported scope")
    credential_path = state_dir / "credentials.json"
    with _SIGNALS.deferred():
        _atomic_json(
            credential_path,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1183)May include surrounding context.

python

def _credentials(state_dir: Path) -> tuple[str, str]:
    state_dir = state_dir.expanduser()
    path = state_dir / "credentials.json"
    if not path.is_file():
        # Not connected yet (or the file is gone): the caller may still find
        # an approval waiting to be collected.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

md

the file ACL. Never copy the Device Token into conversation context, stdout,
stderr, a command argument, an environment variable, a log, a backup, a diff,
or another file. A completed authorization leaves the token only in
`~/.beatra/credentials.json`.

## Ensure Beatra is ready

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 42)May include surrounding context.

python

#: is empty — the script never recursively deletes a directory it does not
#: fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 12)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/updates-and-security.md (reported line 3)May include surrounding context.

md

# Updates and security

Since the October 2026 releases, Beatra Skill packages contain no self-updater.
Earlier releases could replace their own files from Beatra's CDN; that code has
been removed. Updates now come only from the store or tool you installed the
Skill from.

Malformed inventory entries are silently discarded, contradicting the documented rule that uncertainty preserves the shared connection.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

_load_inventory silently removes non-dictionary entries instead of treating the inventory as untrustworthy. If another installed skill's record is malformed, uninstall can incorrectly conclude that no other skills remain, revoke their shared authorization, and delete shared state; the cross-skill connection makes this more consequential than ordinary package cleanup.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 132)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 106)May include surrounding context.

md

- say prominently that a signed-out browser lands on Beatra sign-in first:
  the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
  ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
  in [MCP connection](mcp-connection.md#network-route).

Installation-source attribution is collected from the conversation without a user-facing privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The instructions direct the agent to derive installation-source attribution from the conversation and record it without a user-facing disclosure. This is secondary use of conversational information unrelated to producing narration, although the fixed category list limits exposure and this reference alone does not establish whether the attribution is transmitted externally.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 132)May include surrounding context.

md

Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.

## Use the bundled MCP client

Recurring installation analytics are unrelated to the skill's course-narration purpose.

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The reference documents automatic installation reporting on first use, after installation-context changes, and every 24 hours, including a stable installation reference, installation source, network route, and runtime facts. This store/network analytics capability is not necessary to organize scripts or generate narration audio and is not declared in the manifest's stated purpose. The finding concerns the documented capability; its implementation cannot be independently verified from this reference alone.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The documented project-update command invokes an unpinned npm CLI through npx skills, which can download and execute a registry-resolved package with the caller's permissions. Although this is an updater CLI rather than an MCP server, a compromised package release could execute malicious code; the exposure requires someone to run the suggested command and is not an automatic self-update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The same table row also documents an unpinned npx skills invocation for global updates, exposing the caller to registry-resolved executable code if the CLI must be fetched. This is the same supply-chain issue as the other finding on this line, not an independent MCP-server vulnerability; global scope can additionally affect multiple installed skills.

Content

No source excerpt is available for this finding.

The workflow directs uploading narrator recordings and submitting lecture content without a privacy warning about sharing that data with the service provider.

Medium

• Category: Output Handling
• Confidence: 89% confidence

Finding

The workflow instructs the agent to upload a narrator sample for cloning and synthesize lecture text, potentially sharing identifying audio and private course content with an external provider. Its disclosures address pricing and credit availability, but do not explain this privacy impact; the stated confirmation concerns funding rather than data sharing.

Content

No source excerpt is available for this finding.

Narration authorization requests unrelated image, video, and music generation capabilities (L0045–L0048).

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The narration skill requests image, video, and music generation permissions beyond its stated audio-narration purpose, unnecessarily expanding the authority of its bearer credential. Combined with wallet spending permission and credential sharing across Beatra skills, misuse or compromise could enable unrelated generation jobs and consume account funds; explicit user approval does not eliminate this least-privilege issue.

Content

No source excerpt is available for this finding.