douyin-live-commerce-visual-kit

• Outcome: Review
• Latest audit: Aug 20, 2026 · 12:21 PM UTC
• Version: 0.1.1

Overview

This visual-generation skill is mostly coherent, but it needs Review because it uses a broad Beatra credential and silently self-updates installed files by default.

Install only if you are comfortable granting Beatra a shared, broad device authorization and allowing this package to check for and install updates automatically. Consider running `python3 scripts/mcp_client.py update --auto off` after installation, use it only with media you intend to upload to Beatra, and revoke the device in the Beatra Console when you no longer need it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while instructing use of a bundled Python client that can read local files, write local state, access environment data, execute shell commands, and make network requests. This under-declaration prevents informed consent and hides a broad attack surface, especially because the skill also handles uploads, credentialed registration, and remote operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a visual-design helper but includes credential acquisition, local credential storage, arbitrary remote MCP tool invocation, file upload, installation registration, uninstall/token revocation, and self-update behavior. That mismatch is dangerous because users may provide trust and assets appropriate for design work without realizing the skill can alter the environment, persist auth tokens, and perform broader remote actions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill contains self-updating installation behavior unrelated to its core visual-generation purpose, creating a supply-chain and persistence risk. Even with described verification, auto-replacement of package files means future code can change after initial review, expanding what the skill can do without the user re-evaluating the new version.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The requested OAuth scope is dramatically broader than the skill's stated purpose of generating Douyin live-commerce visuals. It includes artifact access, video/music/speech/voice generation, task cancellation, and especially wallet spending, creating a strong overprivilege condition where compromise or misuse of the skill grants capabilities unrelated to image design.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: Including tasks:cancel gives the skill authority to interfere with task execution beyond what is needed to create visuals. In a shared account environment, unnecessary cancellation capability could disrupt legitimate user workloads or other automations.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Including tasks:cancel gives the skill authority to interfere with task execution beyond what is needed to create visuals. In a shared account environment, unnecessary cancellation capability could disrupt legitimate user workloads or other automations.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Including tasks:cancel gives the skill authority to interfere with task execution beyond what is needed to create visuals. In a shared account environment, unnecessary cancellation capability could disrupt legitimate user workloads or other automations.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file implements a complete self-update pipeline that downloads manifests and ZIP archives from remote infrastructure and then replaces files in its own installation. Even with checksum and path validation, this materially expands the trust boundary and gives the vendor a remote code delivery path unrelated to the skill's stated visual-generation purpose, making compromise of the update channel or signing/distribution process highly impactful.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The code records local skill inventory, installation references, platform, and registration telemetry to local files and sends installation registration to the backend on use. This behavior is outside the visible purpose of generating Douyin live-commerce visuals, so it creates undisclosed tracking and metadata collection risk and broadens the privacy/security footprint of the skill.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The skill fingerprints its execution environment via environment variables and host.json to derive a platform identifier. While not highly dangerous by itself, this is unnecessary for image/visual generation and can aid tracking, environment profiling, or backend policy differentiation without clear user benefit.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Automatic update checks and installs are described as occurring silently without an in-the-moment warning or consent prompt, which undermines user awareness and change control. Silent updates are especially risky here because the package already has network, file, and credential-related capabilities, so new code could materially change behavior between runs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document states that the client performs a silent network check by default and will automatically install a newer version without separate confirmation. Even though it describes integrity checks and rollback protections, default silent update-and-replace behavior reduces user awareness and consent, creating supply-chain and trust-boundary risk if the update channel, signing process, or infrastructure is ever compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation states that the bundled client performs an outbound installation registration call and writes a local cache file, but it does not present these behaviors as an explicit user-facing notice, consent point, or opt-out requirement. Even though the data is described as non-secret and non-billable, silent network telemetry and filesystem writes can violate user expectations, privacy requirements, or enterprise policy, especially in agent environments handling regulated or sensitive workflows.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The script silently writes host metadata including platform and device hostname to host.json without user-facing disclosure. While not a direct code execution issue, this creates an avoidable privacy concern because it persists identifying local-environment data that users may not expect a visual-design skill to collect.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The skill records an inventory entry containing the local install path in skills.json without notifying the user. Local filesystem paths can reveal usernames, project names, or organizational context, making this an unnecessary privacy exposure for a skill whose main function is visual generation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The automatic update path can silently modify installed package files during normal execution without user-facing confirmation. In the context of a design skill, this is especially concerning because it introduces behavior-changing code deployment unrelated to the immediate task and reduces operator visibility into when local code is altered.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 91% confidence
• Finding: A built-in self-modification capability allows the package to replace its own installed code, which is a strong security-sensitive behavior for a skill whose stated purpose is only visual asset creation. Even if intended for maintenance, self-modifying code creates a durable remote change mechanism that can be abused by a compromised backend, CDN, or release pipeline.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.