hot-topic-content-maker

• Outcome: Review
• Latest audit: Aug 28, 2026 · 2:50 AM UTC
• Version: 0.1.7

Overview

The skill's social-content workflow is mostly coherent, but it silently self-updates code and uses a broad shared Beatra credential, so it belongs in Review before installation.

Install only if you are comfortable granting a persistent shared Beatra device authorization with credit-spending and artifact/task capabilities, and consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off` if you need reviewed code to stay fixed. Watch for the paid-call confirmation gates and avoid using it in environments where silent registration, local skill inventory, or shared credential handling is not acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes a bundled Python client and explicitly documents shell, network, file read/write, and credential/state handling behavior, but it declares no permissions. That creates a transparency and consent failure: a host or reviewer cannot accurately reason about what the skill can access or modify, increasing the chance of unintended code execution, network exfiltration, or filesystem changes under the guise of content creation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a social-content workflow, but the documented behavior includes OAuth/device auth, persistent credential storage, generic remote tool invocation, file upload, telemetry/registration, uninstall logic, and automatic package updates. This mismatch is dangerous because users and policy systems may authorize it for low-risk content generation while it actually performs substantially broader and more sensitive actions, enabling stealthy credential handling, data transfer, and code supply-chain changes.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes a silent self-updating mechanism that can replace package-owned files automatically every 24 hours without separate confirmation. Even with integrity checks described, self-update logic materially expands the trust boundary and creates a supply-chain risk: any compromise of the update channel, signing/verification process, or package ownership model could change executable behavior after initial review and approval.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The authorization helper fingerprints the host by reading agent-specific environment variables and the local hostname, then sends platform and device_name as part of the device authorization request. For a trend-content skill, this is unrelated to the advertised functionality and expands collection of host metadata beyond what is necessary, creating unnecessary privacy and environment-disclosure risk.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script records a persistent local inventory of installed skills in ~/.beatra/skills.json, including install_path, platform, and timestamps. This exceeds the content-creation scope and creates unnecessary local surveillance of other installed packages and filesystem locations, which could expose sensitive path information or be repurposed for broader profiling.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements a full self-update system that downloads manifests and archives and then replaces files under the local installation root, functionality unrelated to a social-content creation skill. Even though the updater includes integrity checks, it still gives the skill an embedded mechanism for local code modification and persistence, materially increasing supply-chain and post-compromise risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code records installation telemetry and maintains a persistent local inventory of installed skills and paths, behavior not disclosed by the skill description and not necessary for generating trending content. This creates privacy and tracking concerns and broadens the local data the skill collects about the environment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill fingerprints its execution environment by inspecting agent-specific environment variables and persisted host metadata to infer the platform. For a content-generation skill, this is unnecessary and increases the ability to track, classify, or tailor behavior based on the host environment.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The uninstall script handles shared device authorization state and decides when to preserve or revoke a shared OAuth connection. That capability is outside the advertised purpose of a trend-content creation skill, so it expands the skill's authority into credential lifecycle management and creates a trust-boundary mismatch for users installing a content tool.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This code performs a network call to revoke a shared device OAuth token, affecting authentication state beyond this single skill. Even though the logic tries to be conservative, a content-making skill should not be able to invalidate shared credentials for other components, and any bug, path confusion, or abuse of this script could disrupt access across installed skills.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script enumerates and later deletes files in a shared state directory, including installation and registration metadata unrelated to content creation. Access to shared local state increases blast radius: if invoked unexpectedly or if assumptions about ownership are wrong, it can remove configuration used by other skills or the host environment.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest uses very broad, natural-language descriptions for social-media content generation that overlap heavily with ordinary user requests, but it does not define clear activation boundaries. In agent ecosystems that route or invoke skills based on semantic matching, this can cause overbroad triggering, unintended delegation, and increased exposure of user prompts or downstream tool use to this skill.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The tag list contains many generic and high-collision phrases like trending, same day social post, and what's trending today, which are likely to match common user requests unrelated to intentional skill invocation. This increases the chance of opportunistic routing into the skill, creating unnecessary access to external services and expanding the attack surface for prompt or tool misuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer releases by default without separate confirmation. Even though the text describes integrity checks and rollback protections, silent file replacement changes local code without explicit user consent at the time of update, which can create supply-chain and trust risks if the update channel or signing process is ever compromised.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that the client automatically performs an installation registration call on first use and transmits package and environment metadata, but it does not clearly present this as telemetry or require explicit user awareness/consent. Even if the data is described as non-secret and non-billable, silent outbound network transmission can violate user expectations, privacy policies, or enterprise controls, especially in agent/tooling environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs silent automatic updates in normal execution flow via maybe_auto_update(), modifying installed files without a contemporaneous user-facing prompt. Silent self-modification is risky because it changes the code the user is running outside the expected content-creation action and can conceal unwanted functionality changes.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 91% confidence
• Finding: Referencing credentials.json in a shared application state directory indicates this skill package is aware of and participates in credential handling. In the context of a social-content generation skill, credential access is unnecessary to its stated function and increases the risk of unauthorized token exposure, misuse, or destructive cleanup involving authentication material.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 98% confidence
• Finding: This function reads an access token from credentials.json and uses it to drive revocation logic, demonstrating direct credential access by the skill package. For a content-production skill, this is unjustified privilege; if similar access were repurposed or combined with other code, the token could be exfiltrated or used to alter account/device authorization.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The skill exposes self-update capability as a first-class command and elsewhere contains the machinery to rewrite local package files. For a creative-content skill, self-modification is unusually dangerous because it enables code changes and persistence independent of the host's normal trust and review boundaries.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.