listing-room-video-pack

• Outcome: Review
• Latest audit: Sep 6, 2026 · 3:06 PM UTC
• Version: 0.1.2

Overview

The skill is mostly transparent about being a remote Beatra media workflow, but its default silent self-updater and shared overbroad account token require Review before installation.

Review this before installing. It is not clearly malicious, but it will connect to Beatra, upload selected media, store a shared bearer credential locally, use paid account capabilities, report limited installation/platform metadata, and silently replace package files unless automatic updates are turned off. Install only if you trust Beatra's service and update channel; consider disabling auto-updates and asking the publisher for narrower per-skill OAuth scopes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/authorize.py:33
• Finding: Shared Device Token Requests Permissions Beyond the Skill's Functional Requirements## Vulnerability Details **File Location**: `scripts/authorize.py:33-37` **Vulnerability Type**: Excessive OAuth authorization scope **Risk Level**: Medium ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ### Technical Analysis The authorization helper requests a shared, full-scope Device Token. The declared listing-video workflow requires image and video generation, optional speech generation, catalog voice reads, artifact operations, wallet spending, and task management. It does not declare any need to generate music or modify voice resources. The `music:generate` and `voices:write` permissions therefore exceed the minimum privileges necessary for this Skill. Because the credential is shared by installed Beatra Skills and the bundled MCP client can call a tool whose name is supplied on the command line, unnecessary scopes increase the consequences of token theft, another compromised Skill, or unauthorized local invocation. ### Attack Path 1. An attacker obtains access to `~/.beatra/credentials.json`, compromises another component that shares the Device Token, or gains the ability to invoke the bundled MCP client as the user. 2. The attacker submits an MCP tool call unrelated to the listing-room workflow, such as a music-generation or voice-modification operation. 3. The Beatra service accepts the operation because the shared token includes `music:generate` or `voices:write`. 4. The attacker consumes account credits or modifies voice-related resources beyond this Skill's legitimate scope. ### Impact Assessment Successful exploitation could permit unrelated billable music generation and modification of voice resources. The exposure is limited to the permissions granted by the Beatra Device Token; no evidence indicates local operating-system privilege escalation. N ...[truncated 156 chars]
• Remediation: ## Remediation Suggestions 1. Remove `music:generate` and `voices:write` from this Skill's requested scope. 2. Derive authorization scopes from the specific package's declared capabilities rather than using a common full-scope token. 3. Prefer a package-specific or capability-limited token instead of sharing one broadly privileged credential across all Beatra Skills. 4. Add a local allowlist in `mcp_client.py` so this package can invoke only the tools required by its documented workflow. 5. Require separate, explicit authorization if a user later requests a capability outside the original grant. 6. Add automated tests that compare requested authorization scopes and callable tools against the Skill's declared functionality.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/mcp_client.py:969
• Finding: Default Silent Updater Retrieves and Installs Remotely Controlled Executable Code## Vulnerability Details **File Location**: `scripts/mcp_client.py:969-1018` **Vulnerability Type**: Automatic remote payload retrieval and code replacement **Risk Level**: Medium ```python def maybe_auto_update( *, state_dir: Path | None = None, install_root: Path | None = None, get_bytes: GetBytes = _default_get_bytes, now: float | None = None, ) -> bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( ...[truncated 2887 chars]
• Remediation: ## Remediation Suggestions 1. Change automatic installation to opt-in; default to checking for updates and notifying the user without replacing files. 2. Require explicit confirmation before installing a newly discovered version. 3. Sign release manifests with an offline or otherwise independently protected publisher key and pin the corresponding public key in the audited client. 4. Verify the signature before trusting version information, file lists, URLs, or checksums. 5. Consider a transparency log or reproducible release process so unauthorized releases can be independently detected. 6. Separate update checking from normal authenticated business calls to prevent routine operations from implicitly authorizing code replacement. 7. Preserve the existing redirect, downgrade, archive traversal, ownership, size, rollback, and checksum protections as defense-in-depth.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares no permissions while its documented behavior includes shell execution, file read/write, environment access, and network operations through a bundled client and updater. This creates a transparency and consent gap: a user or host may invoke the skill expecting only media transformation, while it can access local files, credentials, and the network with materially broader power.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a real-estate video generation workflow, but the content also describes OAuth/device authorization, local credential storage, uploads of local files, installation registration/telemetry, uninstall-side state deletion, and silent self-updating package replacement. That mismatch is dangerous because it hides security-relevant behaviors behind an innocuous media-editing description, reducing informed consent and increasing the chance that users authorize credentialed network and code-update activity they did not expect.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest changelog mentions 'top-up tier,' a hardcoded tier price, top-up address, and balance/ledger calls, which are unrelated to a room-video generation skill. This strongly suggests the package was repurposed from a financial or crypto-oriented skill or still contains mismatched operational assumptions, creating a supply-chain trust problem and increasing the risk of hidden wallet, payment, or account-related behavior beyond the declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The skill is presented as turning local listing photos into room video clips, yet it declares authenticated access to a remote MCP service. For a media-packaging skill, undisclosed network access expands the attack surface, enables remote data exfiltration of user media and metadata, and gives the operator influence over processing behavior that users may assume is local-only.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file documents an automatic self-update mechanism that silently checks for and installs newer package versions, which is unrelated to the skill's advertised purpose of generating room video clips from listing photos. Even though the text claims integrity checks and fixed update sources, bundling self-modifying software behavior into an unrelated media-generation skill materially expands the trust boundary and creates supply-chain and unauthorized system modification risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documentation states that the client performs silent update checks and automatically installs higher versions without separate confirmation. For a skill whose purpose is room-video generation, this capability is unjustified and dangerous because it enables code changes on the user's system outside the requested task flow, increasing the risk of covert persistence, supply-chain compromise, or unreviewed behavior changes.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The authorization flow requests a very broad OAuth scope set including wallet spending, voice read/write, music generation, speech generation, and task/artifact operations that are not necessary for a room-video listing skill. Over-privileged tokens significantly increase blast radius: if the token is abused or the backend/package is compromised, an attacker could spend funds, access or modify voice assets, and perform unrelated actions under the user's account.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill is presented as a media-processing package, but this file performs persistent device authorization, host platform detection, hostname collection, and local inventory tracking of installed skills. While some of this may support authentication, the mismatch between declared purpose and collected/persisted metadata reduces transparency and can surprise users, especially when combined with broad scopes.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The client embeds a network-discovered self-update channel and installation/telemetry behavior that are unrelated to the declared room-video processing purpose. Even though the update path includes integrity checks, it enables remote modification of local package code and covert capability expansion outside user expectations, which materially increases supply-chain and trust risk for a media skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the host agent environment by inspecting environment variables and local metadata to derive a platform label. That information is not necessary for converting listing photos into room video clips, and it increases privacy and profiling risk by tying user activity to a specific agent/runtime context.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill persistently records local inventory data and performs registration telemetry to a remote service, which is unrelated to the advertised media-processing workflow. Persistent install-path tracking and package registration create unnecessary privacy exposure and expand the skill's behavior into asset inventorying and outbound reporting.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The manifest references both a local credential file and a remote endpoint, but the user-facing description contains no disclosure that credentials will be used or that content may be sent over the network. This creates a transparency and consent failure that can lead users to expose sensitive listing photos, agent media, or account tokens without understanding the trust boundary.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document normalizes silent checks and automatic file replacement as default behavior without foregrounding that this modifies local software on the user's machine. Lack of prominent warning and consent around system modification increases the chance that users unknowingly permit software changes, which is especially inappropriate in a skill that is ostensibly for media generation rather than system maintenance.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Automatic silent self-update can replace installed package files during normal command execution without a clear user-facing warning. In the context of a simple room-video skill, this is especially risky because users would not reasonably expect local code mutation, and any compromise of the update channel or publisher trust boundary could turn routine use into remote code deployment.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

• Confidence: 88% confidence
• Finding: Referencing a credential file is not inherently malicious, but it is a sensitive capability because it grants the skill a path to authenticated access through local secrets. In the context of a room-video skill, this is more dangerous because users would not reasonably expect access to a bearer credential file for what appears to be a straightforward content-generation task.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 73% confidence
• Finding: This code writes a bearer access token to a plaintext credentials.json file in the user's home directory. Although file permissions are tightened on POSIX, plaintext bearer-token storage remains sensitive because local malware, backup leakage, misconfigured home-directory sync, or weaker non-POSIX permission models could expose a token that carries broad account capabilities.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The client explicitly supports self-modification through package update commands, allowing local code to be replaced from a remote source. Even with checksum validation, self-modifying behavior is high risk for a narrowly scoped media skill because it expands the trust boundary to future remote content and can introduce new capabilities without fresh review or consent.

Static analysis

No suspicious patterns detected.