douyin-video-script-maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 0.1.8

Overview

The skill is a real Douyin script and cover generator, but it asks for broad account powers and can silently replace its own files after installation.

Review this before installing. The core creative workflow is understandable and includes a confirmation gate before paid cover generation, but installation grants a broad shared Beatra token and enables silent package updates by default. Install only if you accept broad Beatra media/spending permissions, remote update trust, local ~/.beatra state, and device/installation registration; consider disabling auto-updates with the provided command if you proceed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Default-On Remote Self-Update Replaces Executable Skill Files Without Independent Signature Verification

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( install_root=resolved_root, update_home=update ...[truncated 4137 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:31

Finding

Device Authorization Requests Spending and Media Privileges Far Beyond the Declared Image-Cover Workflow

Content

View full analysis

dict[str, str]: ... filename, content = _read_local_upload(path) ... result = session.request( 2, "tools/call", { "name": "beatra.assets.upload", "arguments": { "filename": filename, "mime_type": mime_type, "size_bytes": len(content), }, }, ) ``` ### Technical Analysis The declared Skill workflow writes a Douyin script locally and optionally invokes model listing, one image-generation request, and task polling for a ...[truncated 2966 chars]

Remediation

View remediation

other

Warning

• Location: scripts/authorize.py:361

Finding

Authorization Transmits the Local Hostname Without Clear Documentation or an Opt-In Control

Content

View full analysis

str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The collected value is submitted to the remote authorization service: ```python host_platform = detect_host_platform(platform) device_name = device_display_name() write_host_config(state_dir, platform=host_platform, device_name=device_name) ... form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEVICE_AUTHORIZATION_URL, form) ``` ### Technical Analysis The code reads the local hostname, stores it in `~/.beatra/host.json`, and transmits it to `https://api.beatra.ai/oauth/device_authorization`. It also detects the current agent environment from process-environment signatures and submits that platform value. Reading a single hostname is limited environment reconnaissance rather than broad network discovery: the code does not enumerate interfaces, resolve the FQDN, determine the local IP address, scan hosts, or query cloud metadata. The stated purpose—showing a recognizable device name in a console—is plausible. However, hostnames often reveal personally or organizationally identifying information, such as employee names, asset tags, department identifiers, customer names, or internal naming conventions. The installation d ...[truncated 1510 chars]

Remediation

View remediation

` for console display. 3. Add an explicit `--device-name` option and transmit a name only when the user supplies one. 4. Provide an `--omit-device-name` or privacy mode that suppresses hostname storage and transmission. 5. Clearly disclose all authorization telemetry before opening the approval page, including hostname, platform, package version, package slug, and stable installation reference. 6. Define retention, deletion, and account-association behavior for this telemetry. 7. If a hostname is retained locally, apply the same private atomic-write protections used for other state files. 8. Continue avoiding broader reconnaissance such as interface enumeration, IP/FQDN resolution, cloud metadata access, or network scanning. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requests music:generate, speech:generate, voices:read, and voices:write even though the metadata describes script writing and cover image generation, not audio synthesis or voice management. This mismatch indicates unnecessary privilege expansion, increasing the blast radius if the credential is abused and exposing unrelated account capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation references uninstall logic, deletion of local state under ~/.beatra, installed-skill inventory inspection, and network revocation workflows that are unrelated to normal Douyin content generation. Bundling lifecycle-management powers into a content skill creates unnecessary authority over local state and increases the chance of destructive or privacy-impacting actions being triggered from a misleading context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation references uninstall logic, deletion of local state under ~/.beatra, installed-skill inventory inspection, and network revocation workflows that are unrelated to normal Douyin content generation. Bundling lifecycle-management powers into a content skill creates unnecessary authority over local state and increases the chance of destructive or privacy-impacting actions being triggered from a misleading context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation references uninstall logic, deletion of local state under ~/.beatra, installed-skill inventory inspection, and network revocation workflows that are unrelated to normal Douyin content generation. Bundling lifecycle-management powers into a content skill creates unnecessary authority over local state and increases the chance of destructive or privacy-impacting actions being triggered from a misleading context.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 64)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The OAuth scope request is far broader than the advertised functionality of a Douyin script and cover generator. In particular, requesting artifacts, image/video/music/speech generation, voice management, task control, and wallet spending creates a major over-privilege condition: if the skill or its credential is abused, an attacker gains capabilities well beyond script creation, including potentially billable actions and access to unrelated user assets.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requests music:generate, speech:generate, voices:read, and voices:write even though the metadata describes script writing and cover image generation, not audio synthesis or voice management. This mismatch indicates unnecessary privilege expansion, increasing the blast radius if the credential is abused and exposing unrelated account capabilities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This client does much more than a Douyin script generator should: it implements package self-update, installation-state management, telemetry registration, local inventory tracking, and credential-backed remote command brokering. That broad privileged behavior materially increases the attack surface and enables post-install behavior changes unrelated to the advertised skill, which is especially risky in an agent skill expected to perform creative generation only.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill maintains a local skills inventory and silently registers installations to a remote service on use, behavior unrelated to user-requested Douyin content creation. This creates unnecessary device-level surveillance/telemetry and can expose package usage, install paths, platform details, and persistent identifiers without clear runtime disclosure.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The package exposes explicit self-update functionality and elsewhere contains the logic to download, verify, and replace its own installed files. Self-modifying behavior is dangerous in an agent skill because it can change reviewed code after installation and creates a supply-chain pivot if the update channel or publisher account is ever compromised.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The function reads an access token from ~/.beatra/credentials.json and uses it for a privileged revocation operation. Although the apparent purpose is uninstall cleanup rather than theft, this is still credential access by a non-core skill component, and in this skill context it is more dangerous because the skill’s advertised purpose has nothing to do with account or device administration.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool scope even though its instructions require shell execution, network access, local file reads/writes, and environment interaction via a bundled client. Without a tight permission boundary, a creative-content skill can invoke materially broader capabilities than users would expect, increasing the blast radius if the package is compromised or misused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes a self-updating mechanism that downloads and replaces package files, which is unrelated to the user-visible task of drafting scripts and covers. Even if the update path is claimed to be verified, silent code replacement materially expands supply-chain risk and can change the skill's behavior after approval without contemporaneous user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Silent automatic updates without point-of-action warning mean the code executing during a later session may differ from what was originally reviewed or approved. In a skill that already has shell, file, and network reach, this weakens trust boundaries and can turn a one-time permission grant into ongoing exposure to newly delivered behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json

"icon": "https://beatra.ai/textures/icons/douyin-video-script-maker-0.1.1.png",
  "localized": {
    "en": {
      "description": "Create a Douyin short-video script, Douyin spoken script, or Douyin product-video script from a topic, product or service facts, audience, and creator voice. This AI Douyin script writer produces three hook options, a ready-to-film short-video script, shot-by-shot beats, natural spoken lines, subtitle cues, title ideas, hashtags, and a comment prompt for knowledge sharing, local business, product demos, reviews, unboxings, shop content, and creator series. The chosen title then becomes a matching vertical 9:16 Douyin cover with a headline-safe composition.",
      "display_name": "Douyin Video Script Maker",
      "summary": "Turn a video topic, product, service, or creator idea into three hooks and a ready-to-film Douyin script with spoken lines, shot beats, caption cues, a title, hashtags, and a comment prompt.",
      "tags": [

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation. Even with integrity checks and rollback protections, silently replacing executable/package files by default is a security-relevant behavior that can violate user expectations, reduce change control, and increase supply-chain risk if the trusted update source or signing process is ever compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 64)May include surrounding context.

md

the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
  detect completion yourself — never ask the user to confirm in chat that
  they approved.

Approval legitimately takes minutes when sign-in or account creation is

Static analysis

No suspicious patterns detected.