influencer-fit-analyzer

• Outcome: Review
• Latest audit: Oct 21, 2026 · 3:58 AM UTC
• Version: 0.2.3

Overview

Connecting this skill grants account permissions beyond creator research, and an uninstall safeguard flaw could disconnect other Beatra skills.

Review the full Beatra authorization before connecting: it includes generation and voice-management access beyond research. Pasted creator data can produce a shortlist without paid lookups. Installation telemetry runs automatically, and optional uploads send selected files externally. Use the Beatra Console to revoke access when needed; a damaged installation inventory can make uninstall affect other Beatra skills.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Wallet spending permission is consistent with the explicitly disclosed paid lookups, so that portion is not inherently a mismatch. However, the reported media-generation and voice-management permissions exceed this workflow's needs, and persistent shared authorization increases the consequences of credential compromise or misuse; per-lookup confirmation instructions do not technically restrict those permissions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code performs installation and authorization lifecycle management rather than influencer research or shortlist generation. Although uninstall functionality can be legitimate package maintenance, managing a shared device credential, revoking authorization, and deleting shared state are substantive capabilities not represented in the declared description. The code includes safeguards for other installed skills, but those safeguards do not eliminate the description–behavior mismatch. This finding does not imply malicious intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The reported installation-linked environment telemetry creates a privacy exposure not explained by the creator-research workflow, while unrestricted remote tool dispatch weakens least-privilege boundaries. User-selected uploads are acknowledged in the security section and are not inherently covert exfiltration, but a generic uploader and dispatcher broaden the consequences of agent misuse unless destinations and operations are technically constrained.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 48)May include surrounding context.

json

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/updates-and-security.md (reported line 32)May include surrounding context.

md

These files are written under `~/.beatra/`. On POSIX that directory is mode
0700. Nothing is written inside the installed Skill directory.

- `credentials.json` (POSIX mode 0600), written by `scripts/authorize.py`: the device credential.
- `installation.json` (POSIX mode 0600), written by `scripts/authorize.py`: the stable installation reference.
- `host.json` (POSIX mode 0600), written by `scripts/authorize.py`: the agent environment, and a device name when one is known.
- `network.json` (POSIX mode 0600), written by `scripts/mcp_client.py`: this computer's network route.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 132)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

md

- `~/.beatra/installation.json` contains one stable, non-secret installation
  reference.
- `~/.beatra/credentials.json` contains the single Device Token.

On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 53)May include surrounding context.

md

and keeps checking through brief network failures. One run waits up to
   about 15 minutes; an approval page stays open for up to an hour;
5. atomically saves the returned Device Token to
   `~/.beatra/credentials.json` without printing an HTTP response body;
6. validates the new credential with the same non-billable MCP request and
   prints `Beatra is ready` only after it succeeds.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 432)May include surrounding context.

python

def _existing_credential(state_dir: Path) -> Path | None:
    path = state_dir / "credentials.json"
    try:
        path_stat = os.lstat(path)
        if not stat.S_ISREG(path_stat.st_mode):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 1008)May include surrounding context.

python

scope = _required_string(polled, "scope")
    if set(scope.split()) != set(SCOPE.split()):
        raise RuntimeError("Beatra authorization returned an unsupported scope")
    credential_path = state_dir / "credentials.json"
    with _SIGNALS.deferred():
        _atomic_json(
            credential_path,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1183)May include surrounding context.

python

def _credentials(state_dir: Path) -> tuple[str, str]:
    state_dir = state_dir.expanduser()
    path = state_dir / "credentials.json"
    if not path.is_file():
        # Not connected yet (or the file is gone): the caller may still find
        # an approval waiting to be collected.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

md

the file ACL. Never copy the Device Token into conversation context, stdout,
stderr, a command argument, an environment variable, a log, a backup, a diff,
or another file. A completed authorization leaves the token only in
`~/.beatra/credentials.json`.

## Ensure Beatra is ready

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 42)May include surrounding context.

python

#: is empty — the script never recursively deletes a directory it does not
#: fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 12)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/updates-and-security.md (reported line 3)May include surrounding context.

md

# Updates and security

Since the October 2026 releases, Beatra Skill packages contain no self-updater.
Earlier releases could replace their own files from Beatra's CDN; that code has
been removed. Updates now come only from the store or tool you installed the
Skill from.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/updates-and-security.md (reported line 56)May include surrounding context.

md

When `scripts/uninstall.py` decides this is the last Beatra skill on the
computer, it first asks Beatra to revoke the device credential when one is
stored. If Beatra refuses, it changes nothing so the run can be repeated.
Otherwise it unlinks exactly these names in `~/.beatra/`: `credentials.json`,
`installation.json`, `host.json`, `skills.json`, `registrations.json`,
`network.json`, `balance-holds.json`, `pending_authorization.json`, and
`.authorize.lock`. It also unlinks `state.json`, `registration.json`, and

Authorization requests spending, media-generation, voice-management, and task-cancellation capabilities unrelated to influencer research.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The authorization scope includes wallet spending, media generation, voice management, and task cancellation, none of which is justified by the stated influencer-research workflow. The helper also requires the full scope when accepting credentials, preventing use of a narrower grant; misuse or compromise of the resulting token could therefore enable financial charges and unrelated account changes, subject to server-side controls.

Content

No source excerpt is available for this finding.

Malformed inventory entries are silently discarded despite the documented fail-safe promise to preserve shared credentials when uncertain.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The inventory loader silently drops non-dictionary entries rather than treating them as an unreadable inventory. If another installed skill's entry is malformed, uninstalling this package can leave no recognized survivors and trigger revocation of the shared device token and deletion of shared state, disrupting other skills. This contradicts the intended fail-safe behavior; exploitation requires inventory corruption or modification, not merely supplying creator-profile content.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 106)May include surrounding context.

md

- say prominently that a signed-out browser lands on Beatra sign-in first:
  the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
  ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
  in [MCP connection](mcp-connection.md#network-route).

The authorization flow grants unrelated media and upload capabilities to an influencer-research skill.

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The documented authorization covers image, video, music, speech, upload, model, and task tools, substantially exceeding the influencer-research workflow's stated needs. If the agent or its shared token is compromised, those additional capabilities could expand unauthorized actions and potentially incur charges; actual consequences depend on server-side permissions and tool behavior not provided here.

Content

No source excerpt is available for this finding.

Installation-source reporting uses conversation-derived metadata without a user-facing privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

The instructions direct the agent to derive installation-source metadata from the conversation and record it without a user-facing disclosure. This is unnecessary for influencer analysis and creates an undisclosed secondary use of conversation-derived information, although the fixed source categories limit sensitivity and this file does not establish whether the command transmits the value remotely.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 132)May include surrounding context.

md

Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.

## Use the bundled MCP client

The skill specifies recurring installation telemetry beyond its advertised influencer-research workflow.

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The document specifies automatic, recurring reporting of a stable installation identifier, installation provenance, network-route information, and runtime characteristics without describing user consent or an opt-out. These fields can support persistent installation tracking and environment fingerprinting unrelated to the advertised influencer-research task. Disclosure and the stated exclusion of prompts, credentials, and file paths reduce the apparent severity, but do not establish authorization; the implementation and actual transmitted fields cannot be verified from this document alone.

Content

No source excerpt is available for this finding.

The reference prescribes a paid media-generation task workflow unrelated to influencer research and shortlisting (L03–L34).

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The manifest describes reading creator profiles and posts and producing an influencer shortlist memo. This reference instead instructs the agent to poll Beatra generation tasks, report charged credits and billable video duration, inspect recent tasks, and cancel remote execution—operations outside the described creator-analysis workflow.

Content

No source excerpt is available for this finding.