product-photo-studio

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:01 AM UTC
• Version: 0.1.9

Overview

This product-photo skill mostly does what it advertises, but it also grants and keeps broad Beatra account authority and silently self-updates its own package files.

Review before installing. Use it only if you are comfortable connecting a Beatra account, uploading product photos to Beatra, storing a broad shared Device Token under ~/.beatra, sending limited installation/platform telemetry, and allowing automatic package self-updates unless you disable them with scripts/mcp_client.py update --auto off.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates effective capabilities for file access, shell execution, network communication, and environment use, but no explicit permissions are declared to the user. That creates a transparency and consent gap: users may invoke a seemingly simple photo-editing skill without realizing it can upload files, store credentials, modify local files, and reach remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The advertised purpose is product photo editing, but the documented behavior also includes OAuth authorization, persistent credential storage, remote uploads, telemetry/registration, uninstall logic, and self-updating package replacement. This mismatch is dangerous because users may provide photos and approvals under false assumptions, while the skill performs broader account, network, and system-modifying actions that materially expand attack surface and trust requirements.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill includes autonomous update and installation-management behavior unrelated to its core task of product photo generation. Even with stated integrity checks, self-update code introduces a supply-chain and local-modification pathway, and automatic package replacement during normal command execution can change behavior after user approval without a fresh security review.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documentation describes automatic outbound installation registration behavior that is unrelated to the stated product-photo editing purpose of the skill. Even if framed as non-billable and limited metadata, it introduces hidden telemetry and external communication that can expose environment and installation identifiers without a clear user need or informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill includes installation tracking capability via package slug, version, platform, and a stable external installation reference, which is not justified by a photo-editing workflow. This creates a privacy and monitoring risk because it enables correlation of installations and environments across time, especially when cached and retried automatically.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope string requests a much broader set of capabilities than a product-photo editing skill appears to need, including artifacts, tasks, voices, speech, music, video, and wallet access. Overbroad authorization violates least-privilege and increases blast radius: if the skill, its runtime, or stored credentials are abused, an attacker gains far more access than necessary for image editing.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The requested scopes include unrelated media-generation permissions such as videos, music, speech, and voice read/write, which do not align with a product-photo skill’s stated purpose. These extra capabilities materially expand what the skill can do if compromised, turning a photo-editing credential into a generalized media-generation and account-access token.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The requested scopes include unrelated media-generation permissions such as videos, music, speech, and voice read/write, which do not align with a product-photo skill’s stated purpose. These extra capabilities materially expand what the skill can do if compromised, turning a photo-editing credential into a generalized media-generation and account-access token.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The client includes a built-in self-update mechanism and package discovery/download behavior that materially exceeds the stated purpose of product-photo transformation. Even though the updater contains several integrity checks, adding code that can fetch and replace local package files increases attack surface and creates an unnecessary capability for a creative image-editing skill.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill records a local inventory of installed skills and sends installation registration telemetry containing package, version, platform, and external installation reference. That behavior is unrelated to transforming product photos and creates unnecessary privacy and surveillance risk by collecting and persisting data about the user's environment.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The code fingerprints the host environment by inspecting environment variables and host.json to classify the agent platform. For a product-photo editing skill, this is not functionally necessary and increases privacy risk by identifying the user's tooling context for telemetry and business calls.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Automatic installation of updates without separate confirmation is a risky system-modifying behavior, especially when not clearly disclosed in the primary skill description. Users expecting image editing may unknowingly authorize software replacement on their machine, increasing the consequences of compromise in update infrastructure, package signing logic, or distribution controls.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation. Even with checksum, path, and rollback protections, unattended self-update and file replacement modify a local installation without an explicit just-in-time warning or consent, which creates supply-chain and user-trust risk if the update channel or signing process is ever compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown states that the client automatically performs an installation registration call and writes a local cache, but there is no indication of a user-facing warning, consent prompt, or privacy notice. Silent network activity and local state creation are dangerous because users may be unaware that the skill phones home and persists tracking-related metadata.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that local files are uploaded to a remote tool, but it does not require a clear user-facing disclosure or consent step before transmission. Because product photos can contain sensitive or proprietary information, silently routing local image data off-host can create privacy, confidentiality, and compliance risks, especially when users may assume the assistant is only processing files locally.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs silent automatic self-updates that can modify local installation files during normal execution without user-facing disclosure at the time of change. Silent self-modification is especially risky in an agent skill because it changes executable behavior after installation and can bypass normal review expectations, even if the transport and manifest validation are reasonably hardened.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The skill explicitly exposes self-update functionality capable of replacing its own installed files. In the context of a product-photo editing skill, self-modification is unnecessary and dangerous because it enables post-installation behavior changes outside the narrow expected purpose, increasing supply-chain and persistence risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.