livestream-bgm-pack

• Outcome: Review
• Latest audit: Aug 24, 2026 · 2:19 PM UTC
• Version: 0.1.1

Overview

The skill can generate livestream background music, but it also uses broad Beatra account authority and silently self-updates installed code by default.

Install only if you are comfortable granting this Beatra package a broad shared device authorization, allowing automatic package updates unless you disable them, and letting it keep local Beatra state under ~/.beatra. Before use, consider turning automatic updates off and review Beatra account/device permissions and billing exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares itself as a playlist generator but documents execution paths requiring shell, network, file read/write, environment access, and a bundled Python client without any corresponding permission declaration. This creates hidden execution and exfiltration capability that users and reviewers would not reasonably expect, increasing the chance of over-privileged execution, credential exposure, or unintended remote actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior substantially exceeds the stated purpose: in addition to generating music, it performs OAuth login, stores bearer tokens, supports broad remote MCP tool calls, uploads local files, sends installation telemetry, uninstalls local state, and performs software updates. This mismatch is dangerous because it hides sensitive security-relevant behaviors behind an innocuous media-generation description, impairing informed consent and making abuse or overreach harder to detect.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill includes self-updating package behavior unrelated to the core task of composing a livestream BGM playlist. Any self-modifying installation logic increases supply-chain risk because future code can change after review, and the update path runs in the same trust context as the skill's shell/network/file capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest presents a simple music-playlist generator, but the runtime silently checks for and installs software updates. Silent install behavior is especially risky in this context because it changes the reviewed codebase after deployment, potentially introducing new capabilities or malicious code without fresh review or clear operator awareness.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation describes a client that silently checks for updates and automatically installs newer versions before normal commands, which is unrelated to the stated purpose of generating livestream background music playlists. Even though the text claims verification and rollback protections, this still introduces a self-modifying software/update channel into a low-risk content-generation skill, expanding the attack surface and creating a path for unexpected code or file changes on the user's system.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The file documents silent automatic package updates, archive download, verification, and replacement of package-owned files, none of which are necessary for generating music playlists. In the context of this skill, such capabilities are unusually powerful and dangerous because they normalize unattended modification of installed software and could be abused if the update source, client logic, or trust assumptions are ever compromised.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This file introduces billing, task recovery, authorization, and model-listing behavior that is outside the stated purpose of a livestream BGM playlist generator. Even if framed as operational guidance, unrelated payment and account-recovery instructions can normalize broader account actions and increase the chance the skill triggers or social-engineers billable/API operations that users did not expect.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The instructions to run authorization scripts and potentially force full-account reconnection exceed what users would reasonably expect from a playlist-generation skill. In context, this is dangerous because it conditions the operator to perform credential and scope-changing actions that could expose broader account access or enable misuse beyond music generation.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documentation describes outbound installation registration, persistence to a local cache, and environment-linked tracking behavior that is not necessary for a skill whose stated purpose is generating livestream background music playlists. This mismatch increases the risk of undisclosed telemetry and user tracking, especially because the behavior occurs automatically on first use and is framed as independent of the user’s creative task.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file documents external registration plus platform resolution from environment signatures or host metadata, which amounts to installation fingerprinting behavior. For a BGM playlist generator, this capability is unjustified by the advertised functionality and could be used to correlate installations across environments or build a usage profile without meaningful user awareness.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The OAuth scope set is far broader than the stated purpose of a livestream BGM playlist generator. Requesting wallet spending plus image, video, speech, voice, and task permissions violates least privilege and means a compromise or misuse of this skill would grant access well beyond music generation.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Task read/cancel permissions allow visibility into and control over jobs outside the narrow purpose of generating a BGM pack. In the wrong hands, these permissions could expose metadata about other operations or disrupt unrelated user tasks.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Task read/cancel permissions allow visibility into and control over jobs outside the narrow purpose of generating a BGM pack. In the wrong hands, these permissions could expose metadata about other operations or disrupt unrelated user tasks.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Task read/cancel permissions allow visibility into and control over jobs outside the narrow purpose of generating a BGM pack. In the wrong hands, these permissions could expose metadata about other operations or disrupt unrelated user tasks.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The client embeds a full self-update channel and related remote package-management behavior that is unrelated to the advertised BGM-playlist generation purpose. In a skill context, hidden code-update capability materially increases supply-chain risk because future code can be fetched and installed automatically, changing behavior after review without a contemporaneous user security decision.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code records local skill inventory and performs installation registration telemetry that is not necessary for generating music playlists. Collecting and transmitting package/version/platform/install-state data broadens privacy exposure and creates covert tracking capability that is especially suspicious in a consumer-facing creative skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill fingerprints the host environment via environment variables and local state to classify the running agent platform. That information is unnecessary for playlist generation and can be used to tailor behavior, evade detection, or enrich telemetry, making it more concerning because the declared skill purpose does not justify environment identification.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill exposes arbitrary local file upload functionality, allowing any readable regular file to be sent to a remote service once the caller provides a path and MIME type. For a BGM playlist generator, this exceeds expected scope and creates a direct exfiltration primitive that could be abused to upload sensitive local data under the user's credentials.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This uninstall script manages shared Beatra device state and can participate in revoking shared authorization, which is unrelated to the advertised purpose of generating livestream background music. Even if intended for lifecycle cleanup, it gives the skill authority over credentials and cross-skill connectivity, expanding blast radius beyond this package's functional scope.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code performs a network POST to revoke a shared device token, affecting all skills that rely on the same Beatra connection. In a music-generation skill, this is overprivileged behavior: if triggered unexpectedly or abused, it can cause denial of service across unrelated installed skills and disrupt the user's account linkage.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill states that newer releases install automatically without separate confirmation, and the warning is easy to miss. This is dangerous because users may invoke a benign-seeming music skill but unknowingly authorize execution of newly downloaded code, creating a direct supply-chain and persistence risk if the update channel is ever compromised or expanded.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation states that the client silently installs higher versions automatically without separate confirmation, but does not provide a prominent warning that this modifies local package files. Even if intended for maintenance, silent system modification without explicit user acknowledgment is risky because users may not understand that ordinary commands can trigger software replacement.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation states that first use triggers an automatic external registration call and writes a local cache file, but it provides no user-facing notice or consent mechanism. Silent network communication and local persistence can violate user expectations and privacy requirements, particularly in a simple media-generation skill where users would not reasonably expect telemetry.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code performs silent automatic self-updates during normal execution and suppresses failures, meaning installed package files can change without a user-facing warning at the time of use. Even with checksum validation, this undermines reviewability and trust boundaries because the skill can evolve beyond what was originally inspected.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 76% confidence
• Finding: This function reads an access token from ~/.beatra/credentials.json so the skill can use it for remote revocation. While not exfiltrating the token, it grants the skill code direct access to shared credentials unrelated to its music-playlist purpose, increasing the consequences of compromise or malicious modification of the package.

Static analysis

No suspicious patterns detected.