Back to skill

Security audit

AI Product-on-Model Locale Studio

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent image-generation purpose, but it also requests broad account powers and silently self-updates local package files, so it needs Review before installation.

Install only if you are comfortable granting this Beatra package a shared, broad Device Token and allowing default-on self-updates. In a managed or sensitive environment, require publisher justification for the broad OAuth scopes and disable automatic updates with `python3 scripts/mcp_client.py update --auto off` before normal use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises no explicit permissions, yet its documented operation requires shell execution, local file access, network access, credential storage, and package modification behavior. This is dangerous because users and hosts cannot make an informed trust decision when the effective capabilities are broader than the declared permission model, increasing the chance of unintended data access or command execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill's stated purpose is image generation for ecommerce, but the documentation also includes authentication, persistent credential handling, arbitrary remote tool invocation, local uploads, telemetry/registration, uninstall cleanup, and self-update logic. This mismatch is dangerous because it conceals materially broader behavior than a user would expect from the description, creating a trust gap that could enable overcollection of data, credential misuse, or unauthorized system changes.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill documents a silent automatic update mechanism that downloads and installs new package versions, which is unrelated to the core image-generation task exposed to the user. Even with claimed verification, silently replacing local package files introduces supply-chain risk and removes user control over code changes that may alter future behavior or expand capabilities.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The documentation describes automatic installation registration to a remote service and collection of package, version, platform, and a stable external installation reference, which exceeds the stated image-generation purpose of the skill. Even if described as non-billable and non-secret, this is telemetry-like behavior that can create tracking and privacy risk, especially because it occurs on first use and is not necessary to fulfill the user’s creative task.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The file documents environment resolution from signatures or a host file plus registration of a stable installation reference, which amounts to host/environment fingerprinting unrelated to apparel image generation. This increases the ability to correlate installations over time and across requests, creating unnecessary privacy and inventorying risk if the backend or logs are misused or compromised.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The OAuth scope set is far broader than the skill’s stated purpose of generating product-on-model images for ecommerce. In particular, it bundles unrelated capabilities such as video, music, speech, voice management, task control, and wallet spending, violating least privilege and materially increasing blast radius if the token is abused or the skill is compromised.

Context-Inappropriate Capability

Critical
Confidence
95% confidence
Finding
The requested videos:generate scope exceeds the skill’s stated image-focused purpose and creates unnecessary privilege. While less severe than wallet access, it still broadens token abuse potential and could incur cost or create unintended content using the user’s account.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The requested videos:generate scope exceeds the skill’s stated image-focused purpose and creates unnecessary privilege. While less severe than wallet access, it still broadens token abuse potential and could incur cost or create unintended content using the user’s account.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The requested videos:generate scope exceeds the skill’s stated image-focused purpose and creates unnecessary privilege. While less severe than wallet access, it still broadens token abuse potential and could incur cost or create unintended content using the user’s account.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The skill contains a full self-update subsystem that downloads manifests and archives from remote infrastructure and replaces local package files. Although it performs several integrity checks, this behavior materially exceeds the declared image-generation purpose and creates a remote code modification channel that can change the skill after installation, including via silent update paths.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code records local skill inventory and sends installation registration telemetry unrelated to the fashion-imaging functionality users would expect. This expands data collection and local persistence beyond least-privilege, creating privacy and governance risk if deployed in sensitive agent environments.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The client fingerprints the host environment by checking environment variables and host metadata, then attaches platform attribution to business tool calls. This is unnecessary for the stated skill purpose and increases privacy exposure by revealing agent/runtime identity to the remote service.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This function deletes shared state files in ~/.beatra, including credentials and installation metadata for all skills, not just this package. If the last-skill detection is wrong, tampered with, or races with another install, uninstalling one skill can disconnect every other skill on the device and remove shared recovery/audit state.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The update section states that newer versions install automatically without separate confirmation, but it does not present a prominent warning at the point of use that remote code will be downloaded and local package files modified. This is dangerous because users may unknowingly authorize software changes and network activity simply by using a skill that appears to be for product imagery.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The document states that the client silently checks for and automatically installs newer releases before ordinary commands, without separate confirmation. Even with checksum and source validation, silent self-updating changes local code and behavior without an explicit just-in-time warning or consent, which increases supply-chain and unexpected system modification risk.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The documentation states that the client automatically performs registration and writes a local cache file, but it does not present this as a clear user-facing warning or consent flow despite its telemetry-like nature. In a skill focused on creative image generation, hidden or weakly disclosed background reporting undermines transparency and can violate user expectations or organizational policy.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill performs automatic silent updates in the background and can modify installed files before executing normal commands, without runtime user warning. Even with checksum validation, silent self-modification reduces auditability and creates a strong supply-chain risk because future behavior can change outside the reviewed package contents.

Credential Access

High
Category
Privilege Escalation
Content
def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):
Confidence
88% confidence
Finding
This function reads the bearer token from credentials.json into process memory so it can be used for remote revocation. While not exfiltration by itself, it gives this skill code direct access to shared credentials unrelated to its image-generation purpose, increasing the blast radius if the skill package is modified or compromised.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
96% confidence
Finding
The exposed 'update' command and associated package replacement logic enable self-modification of the installed skill code. In the context of a fashion imaging skill, self-modification is outside expected functionality and significantly increases supply-chain and persistence risk, especially combined with automatic update support.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.