douyin-video-script-maker

• Outcome: Review
• Latest audit: Aug 20, 2026 · 1:34 PM UTC
• Version: 0.1.5

Overview

This skill has a clear creative purpose, but it also installs a broad Beatra client with silent updates, shared credentials, and account-wide authority that users should review carefully.

Install only if you are comfortable giving this package a shared Beatra device connection with broad media and wallet authority. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, and review Beatra device revocation behavior before uninstalling if other Beatra skills share the same connection.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares no permissions while its instructions clearly require shell execution, filesystem access, network communication, environment use, and local state changes. This is dangerous because it hides the true privilege and attack surface of the package, preventing informed consent and making abuse or unintended side effects harder to detect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is simple script and cover generation, but the skill also performs authentication, persistent credential storage, remote tool invocation, file upload paths, registration/telemetry, update/install behavior, and uninstall flows. That mismatch is dangerous because users may authorize a low-risk creative skill without realizing it behaves like a networked software installer and credentialed client with broader capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill includes silent self-updating behavior unrelated to its core creative function. Any self-update mechanism expands the supply-chain attack surface, and silent installation without an explicit runtime approval path can change code after review, undermining trust and reproducibility.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: This documentation describes a bundled client that silently checks for and installs software updates, which is unrelated to the stated purpose of a Douyin script-generation skill. In this context, introducing self-updating package modification behavior expands the trust boundary and creates supply-chain risk, especially because users interacting with a content tool would not reasonably expect local software replacement logic.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file states that a client silently installs newer releases by default without separate confirmation. For a Douyin content-generation skill, this is unjustified privileged behavior that could modify local files and execute attacker-controlled supply-chain changes if the update channel is ever compromised, making the mismatch between functionality and capability especially dangerous.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope set is far broader than the stated purpose of this skill. A Douyin script-and-cover generator should not need wallet spending, voice management, task cancellation, music generation, or broad artifact/task access; requesting them grants the operator unnecessary account capabilities if the credential is later abused or the service is compromised.

Context-Inappropriate Capability

Critical

• Confidence: 91% confidence
• Finding: Task cancellation is not a core requirement for generating scripts and covers. While lower risk than spending or voice management, it still allows interference with other account operations and broadens the token's control surface unnecessarily.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: Task cancellation is not a core requirement for generating scripts and covers. While lower risk than spending or voice management, it still allows interference with other account operations and broadens the token's control surface unnecessarily.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: Task cancellation is not a core requirement for generating scripts and covers. While lower risk than spending or voice management, it still allows interference with other account operations and broadens the token's control surface unnecessarily.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: Task cancellation is not a core requirement for generating scripts and covers. While lower risk than spending or voice management, it still allows interference with other account operations and broadens the token's control surface unnecessarily.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Task cancellation is not a core requirement for generating scripts and covers. While lower risk than spending or voice management, it still allows interference with other account operations and broadens the token's control surface unnecessarily.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The client embeds a full self-update mechanism that downloads code and replaces installation files, which is unrelated to the advertised Douyin script-generation purpose. Even though the updater performs several integrity checks, it still gives the package remote code modification capability and expands the trust boundary well beyond what a content-creation skill should need.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill records local install inventory and performs installation-registration telemetry that is not necessary for generating Douyin scripts or covers. In a creative skill context, this extra state collection and outbound metadata transmission is suspicious because it increases privacy exposure and creates undisclosed tracking behavior.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the host agent environment via environment variables and local host metadata to derive a platform identifier. For a Douyin script-making skill, this collection is unnecessary to deliver the promised function and can be used for tracking, targeting behavior by host, or selectively changing network interactions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is presented as a Douyin content-generation tool, but this file implements uninstall logic that manages shared device credentials and decides when to revoke them remotely. That is a privileged lifecycle function unrelated to the declared skill behavior, and it expands the trust boundary by giving the skill access to shared authentication state that could affect other installed skills.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code performs a remote POST to revoke a device authorization token, which is unrelated to generating video scripts or covers. Even though the implementation tries to be conservative, a skill package should not have authority to invalidate shared device access, because compromise or misuse could disrupt other skills and break the user’s environment.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script enumerates and later removes files in ~/.beatra, including shared installation and registration state, which is outside the scope of a Douyin script-making skill. Access to shared local state creates a cross-skill impact surface: a malicious or flawed package could delete or corrupt credentials and metadata used by other skills.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Automatic software updates are performed without a clear user-facing warning at the point of use or a confirmation gate in the skill behavior. Even if the update source is described as verified, silent updates can introduce unreviewed code, surprise network activity, and operational changes that users did not knowingly authorize.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Automatic updates are enabled by default and described as silent, with no clear upfront warning that local package files may be changed during ordinary use. Even if integrity checks exist, default-on silent modification violates user expectations for a simple content-generation skill and reduces transparency around security-sensitive behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The authorization flow sends host_platform and optionally device_name to the remote authorization service without an explicit user warning or consent prompt. Although not highly sensitive by itself, this leaks environment metadata that can aid fingerprinting, tracking, or inventorying user devices, and it is unnecessary to hide from users in a consumer-facing creative skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code can silently auto-update itself during normal command execution, modifying installed package files without prompting the user at the moment of change. In a skill whose stated purpose is content generation, silent self-modification increases operational risk because behavior can change unexpectedly and users may not realize new code was fetched and applied.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The registration flow automatically sends installation and platform metadata as best-effort telemetry without user-facing disclosure in this client code. While not directly enabling code execution, it creates unnecessary background data sharing for a creative skill and weakens user expectations about what information leaves the system.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

• Confidence: 87% confidence
• Finding: The manifest references a local credential file at ~/.beatra/credentials.json for bearer-based authentication to a remote MCP service. While this is a common integration pattern, it creates a credential-access surface: if the skill runtime, logs, prompts, or connected tools can expose file contents or misuse the bearer token, the token could be abused to access the external service.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 95% confidence
• Finding: Referencing credentials.json as part of the state targeted for removal indicates the skill is designed to handle shared credential material. In the context of a content-creation skill, touching credential files is unnecessary and dangerous because it exposes authentication artifacts to package-controlled code and enables account or service disruption.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 99% confidence
• Finding: This function reads access_token from credentials.json so it can be used for revocation requests. Direct credential access by a skill is highly sensitive and unnecessary for the stated purpose, and if this package were tampered with, the same access path could be repurposed to exfiltrate or misuse bearer tokens.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.