First & Last Frame Video

• Outcome: Review
• Latest audit: Aug 21, 2026 · 7:09 AM UTC
• Version: 0.1.4

Overview

The skill appears to generate the advertised videos, but it also grants broad Beatra account authority, stores a shared device token, sends installation registration data, and silently self-updates by default.

Review this carefully before installing. Only install if you are comfortable granting a shared Beatra device authorization with broad media and spending-related scopes, storing that token under ~/.beatra, allowing selected local media uploads, sending package/platform registration data, and accepting silent package-owned auto-updates by default. Disable auto-updates with `python3 scripts/mcp_client.py update --auto off` if you require manual change control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions while instructing use of a local Python client that can read files, write files, access the network, invoke shell commands, and potentially access environment-backed credentials. That mismatch undermines least-privilege and informed consent, because a caller may treat the skill as low-risk while it performs sensitive local and remote operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior extends far beyond creating a two-image transition: it includes authentication flows, persistent credential storage, generic MCP invocation, uploads, telemetry/registration, uninstall actions, and self-updating package management. This broad hidden operational scope increases attack surface and creates opportunities for credential misuse, unwanted data exfiltration, and local system modification that users would not reasonably infer from the skill description.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill authorizes silent self-updating of local package files during ordinary use, even though updating is unrelated to the requested video-generation task. Any mechanism that downloads and replaces executable/package-owned files expands the trust boundary and can be abused through supply-chain compromise, update-channel failure, or implementation flaws, leading to code execution or persistent tampering.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill requests a very broad OAuth scope set, including artifacts, images, music, speech, voices, wallet spending, and task controls, even though the stated skill only needs to generate a first/last-frame transition video. This violates least-privilege and means that if the token is misused, compromised, or the skill is later extended, it could access or spend account capabilities unrelated to the advertised function.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The authorization flow actively provisions the same overbroad scope during device authorization, not just in a constant declaration. Because the token includes unrelated capabilities such as wallet spending and other media-generation functions, users authorizing a simple video-transition skill are exposed to unnecessary account risk if the credential is abused.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The client contains extensive self-update functionality that downloads manifests and archives from remote infrastructure and replaces local package files, behavior far beyond the stated purpose of generating a short transition video. Even with integrity checks, automatic code replacement materially increases supply-chain risk because compromise of the update channel, signing process, or trusted origin would let an attacker push new code into the local environment.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code persistently records local skill inventory and sends installation registration telemetry, which is not necessary for one-off first/last-frame video generation. This creates avoidable privacy and operational risk by accumulating metadata about installed skills, platform, and usage state that could be exposed or misused if the local state directory or backend telemetry system is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The client fingerprints its host environment by inspecting environment variables and persisted host metadata to determine the platform initiating requests. For a video-generation skill, this is unnecessary data collection that increases privacy risk and can aid backend profiling or cross-tool correlation without clear user benefit.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Maintaining a persistent local inventory of installed skills is unrelated to the declared purpose of generating transition videos and expands the skill's visibility into the user's tool environment. Such inventory data can reveal software usage patterns and becomes a surveillance/privacy concern if read by other local processes or transmitted later.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The uninstall script handles shared Beatra device credentials and revocation logic, which is unrelated to the advertised purpose of generating first/last-frame transition videos. Even if intended as lifecycle management, this creates a capability mismatch: installing the skill also introduces code that can affect account-level authentication state and other installed skills, expanding trust requirements beyond the stated video function.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This code enumerates other installed skills via skills.json, reads shared state from ~/.beatra, and may revoke the shared device authorization token. In the context of a video-generation skill, that is an unnecessary privileged capability that could disrupt unrelated skills or be repurposed to interfere with the broader agent environment if the package or update channel were compromised.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Enabling automatic package replacement by default without prominent warning or opt-in means users may trigger local software changes merely by using a content-generation skill. Even if signatures are checked, silent modification of local files is a risky default because it weakens user awareness, complicates auditing, and magnifies impact if the update path is ever compromised.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation states that the client silently checks for and automatically installs newer releases by default before normal commands, which means local package files may be modified without explicit per-update user confirmation. Even though the text describes multiple integrity checks and rollback protections, silent default updates still create security and trust risks because users may not realize code on their system is being changed automatically, and any compromise of the trusted update source or signing/checksum pipeline would be applied without an interactive decision point.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that the bundled client makes an external registration call on first use and transmits package slug, version, platform, and a stable external installation reference, but it does not present this as a clear user-facing disclosure or consent step. Even if described as non-billable and non-secret, this is telemetry-like behavior that can enable installation tracking and environment correlation without the user explicitly understanding that network transmission occurs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The maybe_auto_update() path performs silent best-effort updates before normal commands, modifying installed package files without a user-facing prompt. For a narrowly scoped creative skill, this hidden state-changing behavior reduces user control and turns any upstream compromise into silent code deployment on the client.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: Registration telemetry sends package version, platform, and external installation reference over the network without meaningful user-facing disclosure in the skill's creative description. While not directly enabling code execution, this is an unjustified privacy and transparency issue for a simple media-generation skill.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 91% confidence
• Finding: Referencing credentials.json as part of the files this script manages indicates the skill package is aware of and participates in handling shared authentication material. In this context, access to credential storage is sensitive because a skill unrelated to authentication should not need visibility into shared device credentials, and any such access increases the blast radius of a malicious modification or packaging compromise.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 98% confidence
• Finding: The _device_token function reads and parses ~/.beatra/credentials.json to obtain an access token, then uses it for device revocation. That is direct credential access by a skill package whose declared purpose is video transition generation, making the capability unjustified and dangerous because compromise of this script would enable unauthorized use, exfiltration, or destructive revocation of shared authentication.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The presence of a self-update command exposes explicit self-modification capability in a skill whose stated purpose is only video generation. Self-modifying code meaningfully increases attack surface and trust requirements because future behavior can change after installation, and any compromise of the update pipeline can become arbitrary code deployment.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.