product-launch-opening-film

• Outcome: Review
• Latest audit: Sep 30, 2026 · 1:02 PM UTC
• Version: 0.1.7

Overview

The skill appears to do the advertised Beatra media-generation job, but it also grants broad account access and silently updates its own local code by default.

Review this before installing if you are uncomfortable with a third-party skill storing a shared Beatra device token, using broad Beatra scopes, registering the installation, or silently updating its package files. If you proceed, consider disabling automatic updates with the documented update --auto off command and only approve paid generation cards you understand.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented references indicate the package may uninstall itself, modify local state under ~/.beatra, manage shared connections, and revoke or manipulate authorization, none of which are disclosed by the creative-skill description. Combining creative workflow branding with software-management and account-management behavior increases the risk of users approving actions that affect their system or account beyond the intended task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented references indicate the package may uninstall itself, modify local state under ~/.beatra, manage shared connections, and revoke or manipulate authorization, none of which are disclosed by the creative-skill description. Combining creative workflow branding with software-management and account-management behavior increases the risk of users approving actions that affect their system or account beyond the intended task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented references indicate the package may uninstall itself, modify local state under ~/.beatra, manage shared connections, and revoke or manipulate authorization, none of which are disclosed by the creative-skill description. Combining creative workflow branding with software-management and account-management behavior increases the risk of users approving actions that affect their system or account beyond the intended task.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 53)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 53)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 376)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 955)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1068)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The helper asks for music:generate, speech:generate, voices:read, and voices:write although the manifest emphasizes image/video output for a stage-screen opening film. Overbroad creative-media scopes increase the consequences of token misuse and suggest poor privilege hygiene for a narrowly described skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The client embeds broad self-update and installation-management logic that is unrelated to a product-launch film generation skill's declared purpose. Even though the update path includes several integrity checks, it still introduces unnecessary remote code replacement capability into a creative tool, expanding the attack surface and enabling supply-chain compromise or unexpected behavior changes if the update infrastructure is abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code can mutate local installation files, create backups/journals, delete obsolete files, and recover or roll back prior state. Those capabilities are far beyond what is justified for generating launch-film stills or clips, so in this skill context they materially increase risk: if the remote update channel or local execution context is compromised, the skill becomes a mechanism for persistent local modification.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The exposed CLI supports self-update functionality, meaning the skill can replace its own installed code. Self-modification is inherently risky in a third-party skill and is especially unjustified for a product-launch film generator, because it creates a direct path for persistent code changes through external infrastructure rather than through a trusted host-managed installation process.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1617)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The uninstall script explicitly manages a shared global Beatra connection and can revoke device authorization plus remove shared state in ~/.beatra. That is a privileged administrative capability unrelated to the skill’s declared film-generation purpose, so its presence expands the skill’s authority beyond user expectations and could disrupt other installed skills if the inventory logic is wrong or manipulated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script enumerates and deletes multiple files in the shared ~/.beatra directory, including credentials, registrations, and inventory files. Deleting shared platform state from within a single skill exceeds the stated purpose of the package and creates a risk of denial of service, state corruption, or removal of data needed by other skills.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Referencing credentials.json in the shared state manifest indicates that the uninstall flow is designed to delete credential-bearing material. In context, this is part of broader credential handling by the skill package, which is inappropriate for a film-generation skill and increases the blast radius if the script is invoked in error or modified maliciously.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code reads a bearer token from shared state and uses it to call a device revocation endpoint, giving the skill account/device-management power. Even though the logic is framed as cleanup, this capability is unrelated to the creative function of the skill and could be abused or triggered unexpectedly to disconnect the device from the service.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The _device_token function reads access_token from ~/.beatra/credentials.json, meaning the skill can access live bearer credentials for the shared device connection. For a skill whose purpose is generating launch visuals, direct credential access is unnecessary and dangerous because it enables unauthorized account actions such as revocation or future API misuse if the code is changed.

Content

Scanner excerpt · scripts/uninstall.py (reported line 111)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool/permission scope even though it instructs use of shell, network, file access, and environment-sensitive operations through a bundled client. Without an allowlist, a host may grant broader capabilities than users expect, increasing the blast radius if the skill or its bundled client is compromised or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that the bundled client can automatically download and install newer releases without separate confirmation, replacing package-owned files on the local system. Even with claimed verification, silent self-update materially increases supply-chain risk and can change the code executing on the host after initial review, defeating user expectations and complicating trust decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation states that the client silently checks for and automatically installs newer releases by default without separate confirmation. Even with integrity checks and rollback protections, automatic code replacement changes the local installation state without an explicit per-update user approval, which can violate user expectations and increase supply-chain risk if the trusted update source is ever compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 106)May include surrounding context.

md

- say prominently that a signed-out browser lands on Beatra sign-in first:
  the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
  ask the user to confirm in chat that they approved.

The helper opens no local listener and requires no inbound connection. One

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document states that the bundled client performs a network registration call and writes a local cache file, but it does not explicitly warn users that package/version/platform and a stable external installation reference may be transmitted and persisted locally. Even though the data is described as non-secret and non-billable, undisclosed telemetry and file creation can undermine user consent, violate privacy expectations, and create compliance issues in regulated environments.

Content

No source excerpt is available for this finding.