Hotel Amenity Clips

• Outcome: Review
• Latest audit: Oct 21, 2026 · 4:08 AM UTC
• Version: 0.2.3

Overview

This skill requests account permissions beyond hotel-video creation and can disconnect other Beatra skills if installation records are malformed.

Review the broad shared authorization before connecting: it includes music, speech, and voice-management access that this workflow does not need. Selected photos leave your computer, paid generation spends Beatra credits, and installation analytics are automatic. Request narrower permissions and a corrected uninstall inventory check; removing this package may otherwise disrupt other Beatra skills when records are malformed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence

Findings (32)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied chunk performs uninstall and shared authorization cleanup, not photograph processing or video creation. These account-management and filesystem-deletion capabilities are not disclosed by the description and materially differ from the stated media-production purpose. The script includes safeguards to preserve the shared connection when other skills may remain, but those safeguards do not eliminate the description–behavior mismatch. This finding concerns the supplied chunk, not whether other package components implement the advertised video functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Paid video generation makes spending authorization relevant, and the skill explicitly describes pricing and approval, so wallet:spend alone is not an undeclared capability. However, the reported image, music, speech, and voice-write permissions exceed this workflow, and sharing that broad credential across packages increases the consequences of compromise or misuse. These authorization and storage details are reported by the finding but cannot be independently verified from SKILL.md alone.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The reported automatic transmission of installation identity and runtime information creates a privacy and data-minimization concern beyond processing the user's chosen photographs. Generic remote invocation and file uploads are not inherently vulnerabilities, but they broaden the misuse surface if the client lacks independent authorization checks. The registration reference suggests a legitimate operational purpose, although the supplied file does not establish the exact transmitted fields, consent process, or client restrictions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 53)May include surrounding context.

json

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

md

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 53)May include surrounding context.

md

and keeps checking through brief network failures. One run waits up to
   about 15 minutes; an approval page stays open for up to an hour;
5. atomically saves the returned Device Token to
   `~/.beatra/credentials.json` without printing an HTTP response body;
6. validates the new credential with the same non-billable MCP request and
   prints `Beatra is ready` only after it succeeds.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

md

the file ACL. Never copy the Device Token into conversation context, stdout,
stderr, a command argument, an environment variable, a log, a backup, a diff,
or another file. A completed authorization leaves the token only in
`~/.beatra/credentials.json`.

## Ensure Beatra is ready

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 42)May include surrounding context.

python

#: is empty — the script never recursively deletes a directory it does not
#: fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 12)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/updates-and-security.md (reported line 3)May include surrounding context.

md

# Updates and security

Since the October 2026 releases, Beatra Skill packages contain no self-updater.
Earlier releases could replace their own files from Beatra's CDN; that code has
been removed. Updates now come only from the store or tool you installed the
Skill from.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/updates-and-security.md (reported line 32)May include surrounding context.

md

These files are written under `~/.beatra/`. On POSIX that directory is mode
0700. Nothing is written inside the installed Skill directory.

- `credentials.json` (POSIX mode 0600), written by `scripts/authorize.py`: the device credential.
- `installation.json` (POSIX mode 0600), written by `scripts/authorize.py`: the stable installation reference.
- `host.json` (POSIX mode 0600), written by `scripts/authorize.py`: the agent environment, and a device name when one is known.
- `network.json` (POSIX mode 0600), written by `scripts/mcp_client.py`: this computer's network route.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/updates-and-security.md (reported line 56)May include surrounding context.

md

When `scripts/uninstall.py` decides this is the last Beatra skill on the
computer, it first asks Beatra to revoke the device credential when one is
stored. If Beatra refuses, it changes nothing so the run can be repeated.
Otherwise it unlinks exactly these names in `~/.beatra/`: `credentials.json`,
`installation.json`, `host.json`, `skills.json`, `registrations.json`,
`network.json`, `balance-holds.json`, `pending_authorization.json`, and
`.authorize.lock`. It also unlinks `state.json`, `registration.json`, and

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 432)May include surrounding context.

python

def _existing_credential(state_dir: Path) -> Path | None:
    path = state_dir / "credentials.json"
    try:
        path_stat = os.lstat(path)
        if not stat.S_ISREG(path_stat.st_mode):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 1008)May include surrounding context.

python

scope = _required_string(polled, "scope")
    if set(scope.split()) != set(SCOPE.split()):
        raise RuntimeError("Beatra authorization returned an unsupported scope")
    credential_path = state_dir / "credentials.json"
    with _SIGNALS.deferred():
        _atomic_json(
            credential_path,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1183)May include surrounding context.

python

def _credentials(state_dir: Path) -> tuple[str, str]:
    state_dir = state_dir.expanduser()
    path = state_dir / "credentials.json"
    if not path.is_file():
        # Not connected yet (or the file is gone): the caller may still find
        # an approval waiting to be collected.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 132)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 106)May include surrounding context.

md

- say prominently that a signed-out browser lands on Beatra sign-in first:
  the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
  ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
  in [MCP connection](mcp-connection.md#network-route).

Installation-source collection is instructed without disclosing the privacy implications or where the metadata is recorded.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The instructions direct the agent to derive installation-source metadata from the conversation and record it without notifying the user or explaining its destination. This creates a limited privacy and transparency issue unrelated to producing hotel videos, although the coarse source categories limit sensitivity and the supplied document does not establish external transmission.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 132)May include surrounding context.

md

Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.

## Use the bundled MCP client

The skill specifies recurring installation telemetry unrelated to generating hotel amenity videos.

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The documented client automatically transmits installation and runtime metadata unrelated to producing hotel amenity videos, without an explicit consent or opt-out mechanism shown here. A stable installation reference combined with recurring environment, source, and network-route reporting enables installation-level correlation and creates an unnecessary privacy exposure. The documented field restrictions, non-blocking behavior, and stated analytics purpose reduce the severity; this excerpt does not establish malicious intent or sensitive-content exfiltration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documented npx skills update command does not pin the CLI package version; if the package is not already available locally, npx can download and execute a registry-selected version with the user's privileges. This is a supply-chain hardening issue rather than an unpinned MCP server: exploitation would require a compromised or malicious package release, and the documentation does not itself execute the command.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The global-install variant also invokes npx skills without an exact version, allowing execution of a registry-selected CLI version when it is not available locally. This shares the same supply-chain root cause as the other finding on this line and is not evidence that the skill launches an MCP server.

Content

No source excerpt is available for this finding.

The workflow directs uploading local amenity photos without a privacy warning about sending them to an external service.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

This is an instruction to upload user files, not merely a listing of an available tool. The workflow does not warn that the photos will leave the local system for remote processing, which could expose private or sensitive image content.

Content

No source excerpt is available for this finding.

Authorization requests speech-generation and voice-management capabilities unrelated to producing amenity clips from existing stills.

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The fixed OAuth scope requests speech generation and voice read/write capabilities despite the stated workflow requiring clips from existing hotel amenity stills. These unnecessary permissions expand the damage possible through a compromised credential or misused agent, including unauthorized voice-resource access or modification; the exact-scope checks also reject narrower grants.

Content

No source excerpt is available for this finding.