poster-design-studio

• Outcome: Review
• Latest audit: Aug 20, 2026 · 7:03 AM UTC
• Version: 0.1.2

Overview

This poster-generation skill is mostly coherent, but it silently self-updates installed code by default and uses a broad persistent Beatra credential that deserves manual review before installation.

Install only if you are comfortable with Beatra storing a shared local device token, charging credits after explicit paid-call confirmation, uploading selected source images to Beatra, sending limited installation metadata, and allowing default-on silent package updates. Consider running `python3 scripts/mcp_client.py update --auto off` after installation if you require manual change control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes shell execution, network access, file reads/writes, and use of environment/credential state via the bundled client and update flows. This is dangerous because operators and users are not given an accurate trust boundary: the skill can upload local files, persist credentials, modify files during self-update, and reach remote services without explicit permission disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is poster generation, but the skill also performs account authorization, persistent credential storage, remote MCP/API operations, local file upload, telemetry/installation registration, uninstall cleanup, and automatic package updates. That mismatch is dangerous because it conceals materially different security-relevant behaviors from the user, increasing the chance of uninformed consent to credential handling, data exfiltration via uploads, or code changes through auto-update.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document describes a silent, default-on auto-update mechanism that installs newer releases before normal commands without separate confirmation. Even though it lists integrity and rollback protections, automatically replacing local files without an explicit, prominent user warning or opt-in creates a meaningful trust and change-management risk, especially if users are unaware the tool modifies its own installation during ordinary use.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The documentation states that the client automatically performs an installation registration call and writes a local cache file, but it does not explicitly warn users that metadata will be transmitted off-host or that a file will be created in the user's home directory. While the data described is limited and non-secret, silent telemetry and filesystem writes can violate user expectations, privacy requirements, or enterprise policy if not clearly disclosed.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The client performs automatic silent self-updates that overwrite installation files during normal command execution, with no user-facing confirmation in that path. Although the code includes integrity checks and path-safety controls, any compromise of the vendor update channel, signing/distribution process, or trusted origin would immediately become code execution on client systems, which is especially sensitive for an agent skill that runs locally.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The registration/inventory path transmits environment metadata such as package slug, version, platform, and installation reference, and records local inventory, without user-facing disclosure in this code path. This is not remote code execution, but it does create privacy and telemetry concerns because the skill phones home during normal use and may reveal installation characteristics users did not expect to share.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 91% confidence
• Finding: This codebase intentionally supports self-modification through a built-in update mechanism that can replace package files on disk. Even with checksum, manifest, and path validation, self-updating code in an agent skill materially increases supply-chain risk because successful compromise of the trusted update infrastructure would allow arbitrary code deployment to endpoints.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.