Cover Improvement Preflight

• Outcome: Review
• Latest audit: Aug 20, 2026 · 12:04 PM UTC
• Version: 0.1.3

Overview

The skill largely matches its cover-review purpose, but it needs Review because it grants broad Beatra account authority and silently self-updates by default.

Review the Beatra authorization carefully before installing. This skill can upload selected cover files, spend Beatra credits after confirmations, store a shared Beatra token locally, send package/platform registration metadata, and silently update its own package unless you disable auto-updates with the documented command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares a benign thumbnail-analysis purpose, yet its instructions require broad capabilities including shell, filesystem, environment access, and network use without an explicit permission declaration. That mismatch reduces user visibility into what the skill can actually do and creates a larger attack surface for credential access, file manipulation, remote calls, and unintended system changes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior extends far beyond thumbnail review into OAuth authorization, credential storage, arbitrary remote tool invocation, local uploads, telemetry/registration, uninstall routines, and package updating. This description-behavior mismatch is dangerous because users invoking a design-analysis skill would not reasonably expect account linking, persistent credential creation, remote execution pathways, or software lifecycle operations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill includes an automatic self-updating mechanism unrelated to the core task of analyzing covers, and it installs new code without separate confirmation. Any compromise of the update channel, package signing process, or trust assumptions could turn a content-review skill into a software delivery path for unreviewed code on the host.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is described as reviewing and comparing cover/thumbnail designs, but the requested OAuth scope includes many capabilities unrelated to that function. Overbroad authorization violates least privilege and materially increases blast radius if the skill, its dependencies, or stored credentials are abused.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The authorization request includes images:generate, videos:generate, music:generate, speech:generate, voices:read, and voices:write even though the skill is presented as an analyzer/planner for existing cover assets. These unrelated permissions create unnecessary access to sensitive or billable platform features and expand the consequences of credential compromise.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The authorization request includes images:generate, videos:generate, music:generate, speech:generate, voices:read, and voices:write even though the skill is presented as an analyzer/planner for existing cover assets. These unrelated permissions create unnecessary access to sensitive or billable platform features and expand the consequences of credential compromise.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The client can download manifests and archives from remote infrastructure and replace local installation files, which is materially outside the stated thumbnail/cover-analysis purpose. Even though there are multiple integrity checks, this creates a software-supply-chain and unauthorized code-modification channel inside a content-analysis skill, increasing risk if the vendor infrastructure, signing process, or distribution path is ever compromised.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code records installation telemetry and maintains a local skill inventory unrelated to the declared cover-review function. This expands collection of local metadata and outbound reporting without a clear user need, creating unnecessary privacy and trust concerns, especially in an agent skill that users expect to be narrowly scoped.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill fingerprints its execution environment by checking agent-specific environment variables and host metadata, which is not justified by the described cover-analysis behavior. This can be used to classify the host, support tracking, or adapt behavior in opaque ways, making the skill more dangerous because it gains awareness of where it is running beyond what is needed for image-review tasks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill performs automatic updates without separate confirmation, yet this behavior is not surfaced prominently in the operational summary where users would expect important safety-relevant behavior to be disclosed. Hidden update semantics materially affect trust because the code executed by the skill may change over time without the user's informed awareness.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that the client silently performs network update checks by default and automatically installs newer versions without separate confirmation. Even with integrity checks and rollback protections, this behavior changes local files and initiates network activity without an explicit opt-in, which creates supply-chain and user-consent risk if the update source, signing process, or distribution infrastructure is ever compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that the client automatically makes a registration call and writes to a local cache, but it does not clearly warn users up front that metadata will be transmitted and a file will be created in the user's home directory. Even if the transmitted data is described as non-secret and non-billable, silent telemetry and filesystem modification can violate user expectations, privacy requirements, or enterprise policy, especially in regulated or locked-down environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client performs silent automatic updates during normal command execution and suppresses errors, allowing installed code to change without an immediate user-facing prompt. In the context of a skill that should only analyze covers, silent self-modification increases the blast radius of a compromised update channel and weakens user control over what code is executing.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The exposed self-update command advertises and enables self-modification of the installed package, which is a powerful capability unrelated to the skill's cover-optimization purpose. In an agent-skill context, that capability is especially risky because it creates an alternate execution and persistence path that can change future behavior outside the user's immediate task expectations.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.