personalized-song-maker

• Outcome: Review
• Latest audit: Aug 20, 2026 · 12:00 PM UTC
• Version: 0.1.1

Overview

This skill is genuinely for making personalized songs, but it also requests broad Beatra account powers and silently self-updates by default, so users should review it carefully before installing.

Install only if you are comfortable granting Beatra a persistent shared device token with broad media, task, artifact, and spending permissions, and with the bundled client silently updating package-owned files by default. Turn automatic updates off before use if you require explicit change control, avoid entering sensitive personal details beyond what the song needs, and do not use the upload command unless you intentionally want to send a specific local file to Beatra.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill exposes and instructs use of shell, file, network, and environment-capable operations without declaring those capabilities up front, which breaks least-privilege expectations and hides meaningful execution risk from users and hosts. In this context, those capabilities are not merely incidental: they are used to run a local Python client, persist state, contact remote services, and modify the local installation via updates.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The advertised behavior is a simple lyric-and-song workflow, but the actual skill also performs OAuth/device auth, persistent credential storage, telemetry/registration, arbitrary remote MCP interactions, file upload, uninstall logic, and self-update behavior. That mismatch is dangerous because users may consent to a creative tool without understanding it can alter the local environment, retain credentials, contact external services broadly, and change itself over time.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes a self-updating mechanism that downloads and installs package changes unrelated to the core song-generation task. Even with claimed verification, self-update logic materially expands supply-chain and local integrity risk because the skill can change executable/package-owned files after installation, creating a moving trust boundary.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The authorization scope is far broader than the described purpose of a personalized song generator. Requesting artifacts, images, videos, speech, voice management, task control, and other capabilities violates least privilege and materially increases blast radius if the skill, token, or downstream service is abused.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: Speech generation and voice read/write permissions exceed what is needed for basic song creation as described, especially voice-management rights. These capabilities could be abused to synthesize speech or manipulate voice assets in ways users did not authorize or anticipate.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Speech generation and voice read/write permissions exceed what is needed for basic song creation as described, especially voice-management rights. These capabilities could be abused to synthesize speech or manipulate voice assets in ways users did not authorize or anticipate.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Speech generation and voice read/write permissions exceed what is needed for basic song creation as described, especially voice-management rights. These capabilities could be abused to synthesize speech or manipulate voice assets in ways users did not authorize or anticipate.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The client contains a full self-update system that downloads manifests and archives, validates them, and replaces installed package files at runtime, which is unrelated to personalized song generation. Even with integrity checks, this materially expands the trust boundary and gives the package persistent code-modification capability, making any compromise of the vendor update channel or release process highly impactful.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The client records local skill inventory and sends installation registration telemetry including platform and installation reference, behavior not described by the skill's song-generation purpose. Undisclosed collection of local state and outbound telemetry increases privacy risk and broadens the skill's behavior beyond user expectations, especially in an agent context where users may assume narrowly scoped operation.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill inspects environment variables and host metadata to determine what agent platform it is running under, which is not necessary for composing personalized songs. In this context, environment inspection can reveal operational details about the host or agent ecosystem and contributes to fingerprinting and telemetry without a clear user-facing need.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The client can upload arbitrary local files to the remote service after obtaining an upload grant, while the described workflow is a text-based story-to-song flow. In an agent setting this is especially dangerous because it creates a generic exfiltration primitive: any local readable file the agent is induced to pass to this function could be transferred off-host under the guise of a music skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that newer releases install automatically without separate confirmation, but the user-facing description does not clearly disclose that package files may be modified during ordinary use. Silent modification of local package contents is risky because it prevents informed consent and can introduce new code or behavior between runs.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The manifest explicitly says the workflow collects personal stories, relationships, memories, names, and occasion details, which can include sensitive personal data, yet it provides no user-facing notice about sensitivity, minimization, or consent. In a skill designed around intimate narrative input, this increases the risk of oversharing, collecting third-party data without clear permission, and unsafe handling expectations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document states that the client silently checks for updates and automatically installs them by default, which can modify local files without an explicit up-front warning or consent at the point of use. Even with integrity checks and scoped replacement controls, silent default updates increase supply-chain and user-trust risk because the software changes itself before ordinary commands, potentially surprising users and affecting system state.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that the client automatically sends installation metadata to a remote service and writes a local cache file on first use, but it does not present this as a user-consent event or clearly warn users before transmission and file creation. Even though the data is described as non-secret and non-billable, package slug, version, platform, and a stable external installation reference can still enable tracking, inventorying, or privacy-sensitive attribution across environments.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The workflow explicitly instructs the agent to keep a private ledger containing full frozen arguments, approvals, request IDs, responses, task IDs, and terminal results. In this skill, those records can include sensitive personal story details, names, relationships, and private facts gathered for personalized songs; storing them without minimization, retention limits, or user notice creates unnecessary privacy and data-exposure risk if logs are accessed, retained too long, or reused outside the task.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: maybe_auto_update() performs silent best-effort updates during normal execution and can modify installed package files without contemporaneous user disclosure. For a personalized-song skill, hidden self-modification undermines transparency and makes later behavior differ from what the user originally installed, increasing supply-chain and trust risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The registration flow sends platform and installation-reference telemetry in the background and is described as 'best-effort' so it does not block the requested operation, meaning it may occur without clear user awareness. In this skill context, that is an unnecessary privacy and transparency issue because song generation does not inherently require device registration telemetry.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The package exposes a self-update command that can replace its own installed files, giving the skill an explicit self-modification capability. In a creative song-making skill, this is unjustified by the declared purpose and significantly increases the blast radius of any upstream compromise or misuse, because code can change after installation without external package-manager controls.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.