indie-game-ost-pack

• Outcome: Review
• Latest audit: Aug 24, 2026 · 2:07 PM UTC
• Version: 0.1.1

Overview

The skill is a coherent music-generation workflow, but it also requests broad account permissions, uses shared local credentials, and silently self-updates, so it should be reviewed before installation.

Install only if you are comfortable granting this package a shared Beatra device authorization with broad media and wallet scopes, letting it store credentials under ~/.beatra, and allowing default silent package updates. Disable automatic updates before use if you require reviewed, stable code, and review Beatra account permissions and installed-skill cleanup behavior before authorizing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares itself as a soundtrack generator, yet its documented behavior requires shell execution, network access, file read/write, and environment use without any explicit permission declaration or prominent warning. This hidden capability expansion increases the risk that a user or host agent grants broad execution to a skill whose primary description does not justify such access, enabling credential handling, package modification, and remote operations beyond music generation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented behavior substantially exceeds the stated purpose: beyond generating music, it performs OAuth device authorization, local credential storage, arbitrary remote MCP calls, uploads, telemetry/registration, uninstall logic, and software update management. This description-behavior mismatch is dangerous because users and orchestration systems may trust and invoke the skill under the assumption it only creates OST assets, while it actually introduces account, network, persistence, and software lifecycle risks.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill includes silent self-update and package replacement logic unrelated to its advertised media-generation purpose. Even with stated verification checks, automatic code replacement expands the trust boundary from the installed package to the remote update channel, creating a supply-chain risk where future behavior can change without explicit user review at the time of use.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest presents a music-generation workflow, but the runtime also performs update checks and may install new releases automatically. This mismatch matters because the host agent may invoke the skill expecting deterministic creative behavior, while the underlying executable can change between runs, undermining reviewability, reproducibility, and trust in the analyzed version.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This reference file introduces billing, task submission, authorization recovery, and account-handling behaviors that are outside the declared scope of an indie game OST generation skill. Even though it is documentation rather than executable code, it can steer an agent to perform billable API actions, retry logic, and reauthorization flows the user did not explicitly request, increasing the risk of unauthorized spending or privilege misuse.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The authorization and balance-recovery guidance expands the skill's capability into credential lifecycle management and account-state handling, which is not justified by a soundtrack-generation tool. In an agent setting, these instructions could prompt reconnection flows, scope escalation, or sensitive account troubleshooting that exceeds least privilege and may normalize handling of protected billing state.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The requested OAuth scope is far broader than the stated purpose of an indie game OST generator. In addition to music generation, it requests artifacts write/read, images, videos, speech, voice management, task control, and wallet spending, creating a clear over-privilege condition where compromise or misuse of the skill grants capabilities unrelated to soundtrack creation.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The authorization scope includes image, video, speech, and voice capabilities that are not justified by the skill’s advertised function of producing instrumental game music. This unnecessarily expands the blast radius of any token leakage, malicious update, or downstream abuse by allowing cross-modal content generation and account actions unrelated to OST delivery.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The authorization scope includes image, video, speech, and voice capabilities that are not justified by the skill’s advertised function of producing instrumental game music. This unnecessarily expands the blast radius of any token leakage, malicious update, or downstream abuse by allowing cross-modal content generation and account actions unrelated to OST delivery.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The script collects and persists host metadata including detected agent platform, device hostname, and local install path inventory in `host.json` and `skills.json`. While not immediately exfiltrated here, this is unnecessary for a music-generation skill and increases privacy and reconnaissance risk if local state is later accessed by another component or attacker.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The client for a music-generation skill contains extensive package-management logic including discovery, download, validation, and replacement of local installation files. Even though there are integrity checks, this is functionality unrelated to OST creation and materially expands the trust boundary by allowing the skill to modify its own codebase and installation state.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code fingerprints the execution environment by inspecting environment variables and local host metadata, then attaches that platform label to business requests. For a soundtrack-generation skill, this collection is not necessary to fulfill user intent and creates avoidable metadata leakage and tracking surface.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill records a local inventory of installed skills and sends installation registration telemetry to the remote service during ordinary use. This behavior is unrelated to generating game music and increases privacy risk by building a device-local and server-side picture of installed tooling and usage.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The uninstall script is for a music-generation skill, but it contains logic to manage and potentially revoke a shared device authorization used across skills. Even though the code tries to be conservative, handling shared credentials is a privileged capability outside the stated OST-generation purpose and creates unnecessary security and operational risk if the skill is installed or removed in untrusted contexts.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code performs a network POST to revoke OAuth/device credentials using a bearer token read from local state. For a game-OST skill, remote credential revocation is not functionally necessary and gives the package authority over account/session state, which could be abused or could break other installed skills if the last-skill detection is wrong.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The script enumerates and deletes files under ~/.beatra, including shared installation and credential state for all skills, not just this package. Accessing and removing shared state exceeds the declared purpose of generating music assets and creates a cross-package trust boundary violation, where uninstalling one skill can affect the broader environment.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The docstring emphasizes that the package directory is not deleted, which can create a misleading impression of safety, while the script still deletes broader shared local state under ~/.beatra. That mismatch increases the chance that reviewers or users underestimate the script's side effects and approve a package with wider-than-expected destructive behavior.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that newer releases install without separate confirmation, but this is not disclosed near the main usage or purpose description where a user would evaluate trust. Lack of conspicuous warning increases the chance of uninformed consent to code execution changes, especially in an agent setting where package updates may occur during routine content-generation requests.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The manifest explicitly points the skill runtime at a local bearer-token credential file, but the skill metadata and user-facing description provide no warning that local credentials will be accessed for outbound service use. This creates a transparency and consent problem: users may install a seemingly harmless music-generation skill without realizing it can leverage locally stored authentication material to contact a remote MCP service.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document explicitly states that the client performs silent, default-enabled automatic updates and installs newer releases without separate confirmation. Even though the text describes integrity checks, automatic replacement of installed files without explicit user opt-in or a prominent warning increases supply-chain and unexpected system-change risk, especially if the trusted update source or signing/checking process is ever compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: maybe_auto_update() performs silent update checks and can replace installation files during normal command execution without contemporaneous user confirmation. In the context of a music skill, hidden self-modification is especially risky because users do not expect background code changes when invoking creative tooling.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

• Confidence: 90% confidence
• Finding: Referencing ~/.beatra/credentials.json indicates the skill depends on locally stored authentication secrets, which is a credential-access pattern even if intended for legitimate service authentication. In the context of a third-party skill, this is sensitive because compromise of the skill runtime, unexpected logging, or broader-than-expected MCP permissions could expose or misuse bearer credentials against the external Beatra service.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 94% confidence
• Finding: Listing credentials.json among files the skill may delete indicates the package is designed to manipulate shared credential material. Even if used for cleanup rather than exfiltration, granting a content-oriented skill access to credential artifacts violates least privilege and can cause denial of service or unsafe account/session handling.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 96% confidence
• Finding: The _device_token function reads an access token from credentials.json so the skill can authenticate a revocation request. Reading bearer tokens inside a package script is credential access, and in this skill context it is unnecessary privilege that expands the blast radius if the package is compromised or modified.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The skill exposes self-update/self-modification capability as a supported command, allowing it to replace files in its own installation tree. Even with signature-by-hash style verification from discovery and manifest metadata, self-modifying behavior is high risk in a creative skill because compromise of the update channel or service trust chain can turn the tool into a code delivery mechanism.

Static analysis

No suspicious patterns detected.