Douyin UGC Ad Creator

• Outcome: Review
• Latest audit: Aug 21, 2026 · 7:27 AM UTC
• Version: 0.1.7

Overview

The skill’s ad-creation workflow is mostly coherent, but it also stores broad Beatra credentials, sends installation telemetry, tracks local skill installs, and silently self-updates package code by default.

Review this carefully before installing, especially in managed or sensitive environments. Disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if you need change control, and only authorize the Beatra account if you accept a shared local bearer credential with spending-related scope, installation registration, and local skill inventory tracking.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions while instructing use of a bundled client that performs shell execution, file access, network communication, credential handling, uploads, and local package modification. This under-declaration prevents informed consent and weakens any sandboxing or policy controls that rely on declared capabilities, increasing the chance that sensitive local files or credentials are exposed through normal use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is narrow video creation, but the skill also includes browser-based auth, persistent credential storage, arbitrary remote tool invocation through an MCP client, telemetry/registration, uploads, uninstall behavior, and self-updating code replacement. This hidden expansion of trust boundary is dangerous because users may supply product images and run commands expecting media generation, while the skill is also able to obtain long-lived access, transmit data remotely, and modify the local installation.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The authorization flow derives and persists host metadata such as agent platform and device hostname into local state even though that information is not necessary for the advertised purpose of generating Douyin ad videos. In the context of a narrowly described media-creation skill, this is unjustified host fingerprinting that expands data collection and can aid environment profiling or correlation across installs.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script records a local inventory of installed skills including package slug, platform, and resolved installation path in ~/.beatra/skills.json. For a skill presented as a video/ad creator, maintaining cross-skill inventory and filesystem path tracking exceeds user expectations and creates unnecessary local surveillance data that could reveal other tools in use and sensitive directory structure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill includes an OAuth authorization helper, stores bearer credentials locally, and requests broad scopes including wallet:spend, tasks/artifacts access, and multiple media-generation capabilities that are not reflected in the manifest's narrow description. This mismatch is dangerous because users may install a seemingly simple ad-creation skill without understanding it can obtain spending and broader account permissions beyond the stated function.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The client contains extensive package self-update, installation-state management, rollback, locking, and file-replacement logic that is unrelated to the advertised Douyin ad-creation function. In the context of an agent skill, this materially expands the trust boundary by allowing the skill to fetch remote manifests and replace local package files, creating a software-supply-chain and self-modifying-code risk if the update channel or publisher is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code records local skill inventory and sends installation registration telemetry, including package slug, version, platform, install path-derived identity, and external installation references, despite this being unnecessary for generating Douyin ad creatives. In a creative skill, undisclosed host fingerprinting and local inventory tracking increase privacy and enterprise-environment exposure, especially because the telemetry is performed automatically during normal operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that the bundled client silently checks for and installs newer releases automatically, replacing local package-owned files without separate confirmation. Even if signature verification exists, silent self-update introduces supply-chain and change-control risk because code behavior can change after review, and users may unknowingly execute newly downloaded functionality with existing credentials and permissions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation states that the client silently checks for updates and automatically installs newer releases by default, without separate confirmation. Even with integrity checks and fixed sources, changing installed code without explicit upfront consent expands the attack surface and can lead to unexpected code execution or operational changes on the user's system.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that the bundled client performs a best-effort registration call on first use and sends installation metadata including package slug, version, platform, and a stable external installation reference, but it does not mention explicit user consent, notice, or an opt-out. Even if described as non-billable and non-secret, this is still telemetry-like behavior that can enable user or installation tracking and may violate privacy expectations or compliance requirements in sensitive environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code performs silent automatic self-updates in maybe_auto_update() before normal commands, and suppresses exceptions so runtime behavior changes can occur without clear user awareness. Even with checksum and path validation, silently replacing installed code at runtime is dangerous in an agent skill because it permits unreviewed code changes from a remote source and weakens operator control over what code is executed.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The exposed update functionality enables the skill package to modify its own installed files, which is self-modifying behavior inappropriate for a narrowly scoped media-generation skill. In an agent environment this is especially risky because it allows post-installation code changes independent of the host's normal review or deployment controls, increasing persistence and supply-chain attack potential.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.