Image to Video & Photo Animator

• Outcome: Review
• Latest audit: Aug 21, 2026 · 7:09 AM UTC
• Version: 0.1.6

Overview

This image-to-video skill is review-worthy because it asks for broader account powers and silently updates local code beyond the core animation task.

Install only if you are comfortable granting Beatra broad creative-tool and wallet-spending authority, storing a shared device token under ~/.beatra, sending package/platform/installation metadata to Beatra, and allowing silent package self-updates unless you disable them with the provided update --auto off command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes a bundled Python client for uploads, remote tool calls, updates, and credential-related operations, which implies network, shell, and filesystem capabilities despite no declared permissions. This is dangerous because users and host systems cannot make an informed trust decision when powerful capabilities are hidden or undeclared, increasing the chance of unintended data access or command execution in a sensitive agent environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The published description frames the skill as simple image-to-video generation, but the actual behavior includes OAuth flows, credential management, arbitrary remote MCP tool invocation, uploads, telemetry/registration, uninstall logic, and self-updating package replacement. This mismatch is dangerous because it conceals materially broader trust and attack surface than a user would reasonably expect, making social engineering and overbroad access much more likely.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill requests a sweeping set of scopes far beyond its stated purpose of turning images into short motion clips. In context, image/video generation may be justified, but music, speech, voices, tasks control, and especially wallet spending violate least privilege and create unnecessary access if the token is stolen or the skill is compromised.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The authorization includes unrelated audio and voice permissions (`music:generate`, `speech:generate`, `voices:read`, `voices:write`) that do not match the skill description. These excess privileges broaden the blast radius of any compromise and could enable misuse of user resources, impersonation-related voice operations, or access to capabilities the user did not intend to grant.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The authorization includes unrelated audio and voice permissions (`music:generate`, `speech:generate`, `voices:read`, `voices:write`) that do not match the skill description. These excess privileges broaden the blast radius of any compromise and could enable misuse of user resources, impersonation-related voice operations, or access to capabilities the user did not intend to grant.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The client includes extensive self-update, package replacement, rollback, locking, and installation-state management logic that is unrelated to the declared image-to-motion function. Even though there are multiple integrity checks, this materially expands the trust boundary and attack surface by allowing network-fetched content to replace local package files.

Description-Behavior Mismatch

Low

• Confidence: 86% confidence
• Finding: The client records local skill inventory and installation telemetry unrelated to generating motion from images. In this skill context, collecting local package inventory and external installation references is unnecessary and increases privacy risk by disclosing local environment details and usage metadata to a remote service.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The skill fingerprints the surrounding agent environment by inspecting environment variables and host state to derive a platform identifier. For an image animation skill, this host identification is not necessary for core functionality and increases unnecessary data collection and potential environment profiling.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s behavior is materially outside the advertised image-to-video functionality: it manages shared device credentials, local installation inventory, and remote authorization revocation. Even if intended as an uninstall helper, this gives the skill lifecycle code authority over shared authentication state, creating a high-risk mismatch where installing or removing a media skill can affect account/device access for other skills.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code performs remote device-token revocation and local deletion of shared Beatra state, which is a sensitive capability unrelated to the user-facing purpose of animating images. In the context of a creative media skill, such access is more dangerous because users would not reasonably expect uninstalling the skill to manipulate shared authentication artifacts used by other packages.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that a newer release installs automatically without separate confirmation during ordinary commands, which is a system-modifying action not prominently disclosed in the main skill description. This is dangerous because executing normal skill operations can unexpectedly replace local package files, expanding supply-chain risk and violating the principle of explicit consent for code changes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer releases without separate confirmation. Even with integrity checks and fixed update sources, unattended self-update that replaces local files can violate user expectations, change executable behavior unexpectedly, and increase the blast radius if the update infrastructure or signing/checksum process is ever compromised.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document describes an automatic installation-registration network call that sends package slug, version, platform, and a stable external installation reference on first use without any explicit user-facing notice or consent flow. Even if described as non-billable and non-secret, this is still telemetry-like behavior that can expose environment metadata and create persistent install tracking, especially when combined with a stable identifier.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: maybe_auto_update() performs silent background update checks, downloads, and local file replacement during normal command execution, with exceptions suppressed. In a media-generation skill, undisclosed self-modification is especially risky because users would not expect unrelated network and filesystem mutation when invoking creative operations.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 93% confidence
• Finding: Referencing credentials.json as managed uninstall state indicates the skill participates in handling shared authentication material. Access to credential storage is inherently sensitive; even read/delete-only handling can expose, invalidate, or interfere with account access, especially because the credential is explicitly shared across skills.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 96% confidence
• Finding: The _device_token function reads an access token from credentials.json and passes it to revocation logic, demonstrating direct credential access by the skill code. In a skill whose stated purpose is image animation, direct token handling is unjustified and increases the blast radius if the script is modified, abused, or invoked unexpectedly.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The client explicitly supports self-modification through package update commands and automatic update flows that can replace local code. Self-modifying behavior is dangerous because compromise of the update channel, discovery endpoint, CDN, or upstream release process can turn a benign media skill into a code-delivery mechanism on the host.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.