MiniMax H3 AI Video Creator

• Outcome: Review
• Latest audit: Aug 21, 2026 · 6:59 AM UTC
• Version: 0.1.4

Overview

This video-generation skill is not clearly malicious, but it uses a broad Beatra account token and silently updates its own installed files by default.

Install only if you are comfortable giving this Beatra skill a shared broad Beatra device token, allowing it to upload selected local media for generation, store account/device metadata under ~/.beatra, and silently update its own package files unless you run `python3 scripts/mcp_client.py update --auto off` after install.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities that require broad host access including shell execution, file read/write, environment access, and network use, yet no permissions are declared. This creates a transparency and consent problem: users and policy systems cannot accurately assess or constrain what the skill may do, increasing the risk of unintended data access, code execution, and exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is simple video creation, but the skill also instructs the agent to perform credentialed authentication flows, upload local files, register installations/telemetry, manage account state, and self-update by downloading and replacing package files. That mismatch is dangerous because users may authorize a seemingly narrow creative tool without realizing it can alter local state, transmit local content, and change its own code over time.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The authorization helper derives agent/platform identity from environment variables and captures the local hostname as a device name, then sends and persists that metadata during OAuth device authorization. For a video-generation skill, this data is not strictly necessary to obtain a token and creates unnecessary fingerprinting/privacy exposure if logged, retained, or correlated server-side.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: The code records a local inventory of installed skills including absolute install paths and platform information in ~/.beatra/skills.json. This exceeds the stated purpose of authorizing a video skill and can expose sensitive filesystem layout or usage patterns to other local processes or future telemetry consumers.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The client contains substantial self-update and local file mutation logic unrelated to its advertised video-generation purpose, including downloading archives and overwriting installed package files. Even though there are notable integrity checks, this materially expands the attack surface and grants the skill ongoing capability to alter local code after installation, which is dangerous in an agent-skill context because behavior can change outside the reviewed package contents.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The client performs installation telemetry and maintains persistent local skill inventory data, which is outside the user-facing description of a creative video tool. Hidden persistence and telemetry are risky because they collect environment and usage metadata that users may not expect, and in an agent ecosystem this can support profiling, tracking, or policy-evasion decisions across installs.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The code fingerprints the host environment by inspecting environment variables and persisted host metadata to classify the running agent platform. This is not obviously necessary for video generation and becomes more concerning in combination with telemetry and self-update logic, because it enables behavior differentiation and environment-aware tracking across agent runtimes.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer versions by default, which means local code can be modified without explicit per-update user consent or a prominent warning. Even with integrity checks and fixed update sources, this increases supply-chain risk and reduces user awareness that executing ordinary commands may trigger code replacement on the host.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The text says that running the update command performs an immediate verified update, but it does not plainly emphasize that this action replaces installed files in the local environment. Users may interpret this as a harmless version check or metadata refresh, leading to unintended modification of the installation and avoidable trust and change-management issues.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The document states that the client performs an automatic installation registration call and writes a local cache file, but it does not present this as a clear user-facing notice or consent point. Even though the transmitted data is described as non-secret and the cache as non-billable, silent outbound telemetry and filesystem modification can still create privacy, transparency, and compliance concerns for users and enterprise environments.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: Host metadata is written to disk as host.json without any user-facing notice or consent flow in this file. Even though the data is limited, silent persistence of platform and device name can violate user expectations and creates avoidable privacy risk on shared or monitored systems.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill can silently auto-update itself in the background, performing network fetches and replacing local package files without a user-facing prompt at execution time. In the context of an agent skill, silent code mutation is especially dangerous because reviewed code can later change into materially different behavior, undermining user trust, auditability, and security review boundaries.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 94% confidence
• Finding: The package explicitly exposes self-update capability, enabling local self-modification of installed code. In a skill whose declared purpose is AI video creation, self-modification is unusually powerful and dangerous because it allows the installed behavior to diverge from the reviewed artifact, especially when combined with automatic background update paths.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.