douyin-live-commerce-visual-kit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:16 AM UTC
• Version: 0.1.1

Overview

This is a real Beatra visual-design skill, but it requests broad account powers and silently updates its own code, so users should review it carefully before installing.

Install only if you are comfortable granting this Beatra package a shared, broad device credential and allowing default silent package updates. Consider disabling automatic updates with the documented --auto off command and using a Beatra account where wallet and non-image media permissions are acceptable.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Silent Automatic Updates Permit Post-Audit Remote Code Replacement

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_updat ...[truncated 3016 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:35

Finding

Device Authorization Requests Permissions Unrelated to Static Image Generation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/mcp_client.py:1466

Finding

Generic Call Command Allows Unrestricted Invocation of Credential-Authorized MCP Tools

Content

View full analysis

dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` The command-line parser accepts any tool name: ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The client accepts an arbitrary `tool_name` and forwards it directly through authenticated `tools/call`. There is no hardcoded package-specific allowlist and no local argument-schema validation. This behavior is especially risky in combination with the broad device-token scopes. Although the documented workflow names image, model, installation, artifact, and task tools, the implementation does not enforce those boundaries. Any local caller able to invoke this script—or an agent manipulated into invoking it—can request any MCP tool exposed to the credential. Server-side scope checks remain an external control, but the credential itself includes capabilities unrelated to this Skill. Therefore, the generic call interface converts the package into a general-purpose authenticate ...[truncated 1214 chars]

Remediation

View remediation

other

Warning

• Location: scripts/authorize.py:360

Finding

Authorization Collects and Transmits the Local Hostname Without Clear Necessity

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" ``` It also reads the operating-system hostname: ```python def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The hostname and platform are persisted locally: ```python def write_host_config(state_dir: Path, *, platform: str, device_name: str | None) -> None: """Persist detection results so mcp_client never re-detects per request and still has a truth source when its own env detection comes up empty. Best-effort: config failure must never block authorization.""" ...[truncated 2961 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also includes uninstall/state-management behavior that reads, deletes, and revokes local credentials and installation metadata, which is unrelated to generating Douyin visuals. Such hidden lifecycle-management behavior increases risk of destructive local changes, credential mishandling, and user confusion because the operational scope extends far beyond the advertised creative task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also includes uninstall/state-management behavior that reads, deletes, and revokes local credentials and installation metadata, which is unrelated to generating Douyin visuals. Such hidden lifecycle-management behavior increases risk of destructive local changes, credential mishandling, and user confusion because the operational scope extends far beyond the advertised creative task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also includes uninstall/state-management behavior that reads, deletes, and revokes local credentials and installation metadata, which is unrelated to generating Douyin visuals. Such hidden lifecycle-management behavior increases risk of destructive local changes, credential mishandling, and user confusion because the operational scope extends far beyond the advertised creative task.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

Use bundled `scripts/mcp_client.py` for every remote operation: put the MCP

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

Use bundled `scripts/mcp_client.py` for every remote operation: put the MCP

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

Use bundled `scripts/mcp_client.py` for every remote operation: put the MCP

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

Use bundled `scripts/mcp_client.py` for every remote operation: put the MCP

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 65)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The OAuth scope set requests far more privilege than a Douyin visual-design skill needs, including wallet spending plus audio, music, speech, voice, video, and task-control capabilities. Overbroad authorization violates least privilege and turns any compromise, misuse, or unexpected server-side behavior into a much larger blast radius than the manifest suggests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The requested videos:generate scope is not justified by the manifest, which describes covers, product cards, backgrounds, and visual direction rather than video creation. This unnecessary privilege broadens the account's available actions and creates avoidable risk if the token is misused.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The client contains a full remote self-update mechanism that downloads manifests and archives, validates them, and replaces local package files. Even with integrity checks, this is unrelated to the advertised Douyin visual-design purpose and materially increases supply-chain risk because remote server compromise, signing/discovery compromise, or distribution abuse can change executable local code.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The exposed self-update command explicitly supports modifying and replacing the package's own files, i.e., self-modification. Self-modifying behavior is dangerous in a user-facing skill because it increases the blast radius of any server-side compromise and is unrelated to the stated purpose of producing Douyin live-commerce visuals.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The uninstall script manages a shared Beatra device connection, including credential and inventory state, which is unrelated to the advertised purpose of generating Douyin live-commerce visuals. Because it operates on shared authentication under ~/.beatra, uninstalling this skill can affect other installed skills and introduces privileged behavior beyond what a design tool should need.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script explicitly targets shared state files such as credentials.json, host.json, skills.json, and registrations.json for deletion, which exceeds the needs of a visual-creation skill. Even though the code tries to be conservative, deleting shared authentication and host metadata from a skill package creates a dangerous coupling where removing one package can alter global agent state.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The presence of credentials.json in the list of state files to remove indicates the skill is designed to interact with shared credentials. For a visual-design skill, touching authentication material is over-privileged and dangerous because compromise, modification, or unintended execution of the uninstall path can remove or interfere with the user’s shared authorization state.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code performs a network POST to revoke an OAuth/device token during uninstall, a capability not justified by the skill’s stated visual-generation function. Embedding account-affecting network auth operations inside a content/design skill expands the blast radius of compromise or misuse and can disrupt the user’s broader platform access.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The _device_token function reads an access token from credentials.json so the skill can use it in a bearer-authenticated revocation request. Accessing bearer tokens from within a skill that is supposed to generate livestream visuals is unnecessary and materially increases risk, since token access enables account-level actions outside the skill’s domain.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares broad operational behavior—shell, network, filesystem, environment access—without any explicit tool scope or permission boundary in the manifest. That creates an unnecessary trust gap: a user selecting a visual-design skill would not be warned that it can read local data, invoke a client, and perform remote operations, increasing the chance of over-privileged execution or misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.