instagram-reel-to-pdp-clip

• Outcome: Review
• Latest audit: Aug 28, 2026 · 1:58 PM UTC
• Version: 0.1.1

Overview

The skill appears purpose-built for Beatra video generation, but it needs review because it grants broad account permissions and silently updates package code by default.

Install only if you are comfortable giving Beatra a shared local device authorization that can spend credits and access broader Beatra media tools than this one workflow needs. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, and only provide product stills and public Instagram references you intend to send to Beatra.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill exposes powerful capabilities—shell, network, filesystem, environment access—without declaring permissions or clearly constraining them at the skill boundary. In this context, the document explicitly instructs use of a bundled Python client that can upload files, call remote tools, store credentials, and update itself, so the lack of declared permissions undermines informed consent and prevents effective policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a narrowly scoped Instagram-to-product-video workflow, but the content reveals substantially broader behavior: OAuth login, persistent local credential storage, arbitrary remote MCP tool invocation, local file upload, telemetry/registration, uninstall cleanup, and automatic update installation. This mismatch is dangerous because users may authorize or run the skill expecting media transformation only, while the package actually gains broader system and network reach than the description suggests.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The document states that the skill performs an automatic network registration on first use and transmits package slug, version, platform, and a stable external installation reference, but this behavior is not reflected in the skill's user-facing purpose. Hidden telemetry in a creative media skill creates an unnecessary privacy and trust risk because users may invoke a Reel-to-PDP workflow without expecting background network communication or installation tracking.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Automatic installation registration plus platform/environment fingerprinting is not necessary for the stated function of generating PDP clips from Instagram Reels. Collecting host-environment metadata and persisting a stable installation reference expands the data footprint beyond functional need, increasing privacy exposure and creating an avoidable channel for tracking users or deployments.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope string requests a wide set of capabilities far beyond the stated purpose of converting Instagram reels into PDP product videos, including artifacts read/write, music/speech/voice operations, task control, and wallet spending. This violates least privilege and means that if the credential is misused, compromised, or the skill behaves unexpectedly, it can perform unrelated high-risk actions under the user's account.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: Requesting wallet:spend and voices:read/voices:write for a reel-to-PDP clip skill is especially dangerous because these permissions enable financial actions and management of voice assets unrelated to the advertised functionality. In context, these permissions materially increase blast radius: a stolen or abused token could incur charges or manipulate unrelated account resources without user expectation.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The client includes a full self-update mechanism, installation registration, and telemetry stack that is unrelated to the stated Reel-to-PDP media-conversion purpose. This expands the trusted code surface and allows the package to fetch, verify, and replace local files from remote infrastructure, which is dangerous in an agent skill because it introduces ongoing code mutation and outbound reporting beyond user-expected functionality.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the host agent environment using environment variables and host metadata, then attaches platform attribution to tool and registration calls. In the context of a product-video skill, this collection is unnecessary and increases privacy and tracking risk by revealing execution environment details to the remote service.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill maintains a local inventory of installed skills and performs background installation registration telemetry that does not contribute to Reel-to-PDP clip generation. This creates unnecessary persistence and outbound data flow, making the skill more dangerous because it tracks local installation state and reports it to a backend without being central to the advertised purpose.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The file describes both automatic registration and writes to a local cache file without any clear user-facing warning in the skill context that privacy-impacting behavior occurs. Even if the cache is labeled non-secret, undisclosed local persistence combined with outbound registration undermines informed consent and can surprise users in constrained or regulated environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client performs silent automatic self-updates that can modify installed package files during normal execution without a user-facing warning. Even with integrity checks, this behavior is risky for an agent skill because it changes executable code outside the user’s immediate awareness, increasing supply-chain and trust-boundary exposure.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

• Confidence: 83% confidence
• Finding: The manifest explicitly references a local credential file at ~/.beatra/credentials.json for device-bearer authentication to a remote MCP endpoint. Even though this is common configuration, exposing or depending on a fixed credential path increases the risk of unintended credential access, leakage through logs/errors, or misuse by a skill that connects to an external service, especially when the skill's purpose does not clearly justify privileged token handling in the manifest itself.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The package exposes self-update/self-modification capability, allowing runtime replacement of installed files. In an agent skill whose advertised purpose is media processing, this is especially dangerous because it creates an unnecessary code-execution update channel that can alter behavior after installation and complicates trust review.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.