novel-promo-video-maker

• Outcome: Review
• Latest audit: Aug 21, 2026 · 7:23 AM UTC
• Version: 0.1.4

Overview

This skill appears to be a legitimate Beatra video-generation integration, but it also silently updates its own installed code and stores broad Beatra authorization state by default.

Install only if you are comfortable granting Beatra a shared local Device Token for paid media tools and allowing this package to auto-update itself by default. Consider running `python3 scripts/mcp_client.py update --auto off` after install if you want updates to be manual, and review or revoke the Beatra agent connection from the Beatra Console when you no longer need it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while explicitly instructing use of a bundled Python client that performs shell execution, network access, file reads/writes, environment use, and package registration. This deprives users and hosts of informed consent and weakens policy enforcement, especially because the same client also handles updates and remote task execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a media-generation workflow, but the embedded behavior expands into OAuth login, credential storage, generic remote tool invocation, uploads, telemetry/registration, uninstall logic, and self-updating package replacement. That mismatch is dangerous because users may authorize broad local and remote capabilities they would not reasonably expect from a story-video maker.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill includes a self-updating mechanism that can install newer releases and replace package-owned files, which is unrelated to the core task of creating narrated promo videos. Any compromise of the update channel, signing process, or package publisher could convert this skill into a code-delivery path on the host system.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The authorization helper derives and stores host platform and device hostname in host.json even though that metadata is not necessary to generate promo videos locally. This creates unnecessary device fingerprinting and privacy-sensitive persistence that could expose agent environment details or host identity if the state directory is later read by other software or leaked.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script records a local inventory of installed skills including slug, platform, and absolute install_path, which exceeds the stated purpose of authorizing a video-generation skill. Absolute filesystem paths can reveal usernames, project structure, and other installed components, increasing privacy and reconnaissance risk if the file is exposed.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file implements a full self-update system that downloads manifests and archives from remote infrastructure and replaces files in the installed package, even via silent auto-update paths. Although it performs several integrity checks, this behavior materially exceeds the stated story-video-making purpose and creates a software supply-chain risk: compromise of the vendor update channel or signing/checksum source would let remote code be installed locally.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill records local inventory and sends installation telemetry such as package slug, version, platform, and external installation reference to a remote service on normal use. This exceeds the declared creative function and introduces privacy and tracking risk, especially because registration is performed automatically and best-effort rather than as an explicit user-approved feature.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code fingerprints the host environment using environment variables and host.json, then propagates that platform identifier in business and telemetry calls. For a creative video-generation skill, this collection is not necessary to fulfill the advertised function and increases privacy risk and the ability to profile agent environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that updates install automatically without separate confirmation, but this material behavior is not prominently disclosed in the main description or activation scope. Silent code replacement reduces user control and can change the trust boundary after initial approval, making later executions materially different from what the user originally accepted.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation, which changes local code by default. Even though the text describes integrity checks and fixed update sources, silent self-modification increases supply-chain risk and reduces user awareness and consent, especially if the update infrastructure or signing/checking process is ever compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document describes an automatic network registration on first use that transmits package slug, version, platform, and a stable external installation reference, but it does not explicitly warn the user or require consent. Even if the data is described as non-billable and non-secret, this is telemetry-like behavior and can create privacy and trust issues, especially because the stable installation reference may enable correlation across runs or environments.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: maybe_auto_update() performs silent update checks and package replacement before normal commands, suppressing all exceptions and providing no user-facing warning at execution time. Silent self-modification is dangerous because it changes executable local code outside the user's immediate awareness, magnifying the blast radius of any update-channel compromise or server-side mistake.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 98% confidence
• Finding: The skill exposes self-update functionality that can replace its own installed files, which is a classic self-modification capability. In the context of a novel-promo-video-maker, this is unrelated to the stated business purpose and meaningfully raises supply-chain and persistence risk if the update path is abused.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.