Back to skill

Security audit

music-generation-studio

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Beatra music-generation integration, but it silently self-updates installed files and uses a broad persistent Beatra authorization, so it belongs in Review.

Review this skill before installing. It needs Beatra account authorization, stores a shared token under ~/.beatra, can spend Beatra credits when you approve generation, can upload selected reference audio, records local installation metadata, and silently updates itself by default. Install only if you trust Beatra's update channel and broad shared authorization model; consider running update --auto off after installation if silent updates are not acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documentation directs use of a bundled Python client that can access the environment, read and write local files, invoke shell commands, and make network requests, yet no explicit permissions are declared. That creates a transparency and least-privilege problem: users and hosts cannot accurately assess the real trust boundary before installing or running the skill.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The public description presents the package as a music-generation skill, but the actual behavior includes authentication flows, persistent credential storage, file upload, remote tool invocation, telemetry-style registration, self-update, and uninstall/cleanup logic. This mismatch undermines informed consent and can cause users to authorize a much broader operational footprint than the description suggests.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill authorizes silent self-updating and replacement of package-owned files during ordinary command execution. Any auto-update mechanism that can fetch and install new code expands the supply-chain attack surface and can convert a benign skill into arbitrary code execution if the update channel, signing, verification, or distribution process is compromised.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The authorization helper derives and persists host metadata such as platform fingerprinting and a recognizable device hostname to host.json, even though that information is not necessary to generate music content locally. This creates avoidable collection and retention of host-identifying data that can expose user environment details, especially if the state directory is later accessed, synced, or exfiltrated.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script records a local inventory of installed skills, including slug, platform, and resolved install_path, in skills.json. Maintaining a cross-skill inventory and filesystem installation paths exceeds the narrow purpose of authorizing a music-generation skill and can reveal sensitive information about a user's tool usage and directory layout.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The client contains a full self-update pipeline that downloads manifests and ZIP archives from remote infrastructure and replaces files in the local installation. Even though the code includes several integrity and path-safety checks, this behavior materially exceeds the declared music-generation purpose and creates a software-supply-chain attack surface where compromise of the vendor update channel or signing process leads to arbitrary code replacement on the host.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill records local inventory and sends installation registration telemetry using the user's credential-backed session, despite this not being part of the advertised music-creation functionality. Undisclosed metadata collection expands privacy and tracking risk, especially when tied to stable installation references and platform data.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code fingerprints the host agent environment by inspecting environment variables and persisted host metadata to derive a platform identifier. This capability is unrelated to generating music and can be combined with telemetry to profile users or tailor behavior to specific agent environments, increasing privacy and abuse risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation describes automatic package updates that can modify installed files, but this behavior is not prominently disclosed in the main skill description. Hidden mutability is dangerous because users may trust the reviewed version while the installed package later changes behavior without clear notice or renewed consent.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document states that the client silently checks for updates and installs higher versions automatically without separate confirmation. Even with integrity checks and fixed update sources, automatic file replacement without explicit user warning or consent increases supply-chain and operational risk because code changes can occur unexpectedly during normal use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
maybe_auto_update() performs a silent best-effort update before normal commands, modifying local installation files without an interactive prompt or prominent disclosure. In the context of a music-generation skill, background code replacement is especially risky because users do not expect creative tooling to self-modify, and a compromised update path could change future behavior or implant malicious logic unnoticed.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The registration flow sends installation metadata over the authenticated session without any user-facing notice in this file, making telemetry easy to miss. While not directly enabling system compromise, it creates a transparency and privacy issue because credential-backed communication is being used for non-core functionality.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
94% confidence
Finding
The presence of a built-in self-update/self-modification command means the skill can replace its own package files on disk. Even when framed as maintenance, self-modifying code in a skill whose stated purpose is music generation is a strong security concern because it enables post-install behavior changes outside the user's expected workflow and increases supply-chain risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.