Back to skill

Security audit

product-video-studio

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed Beatra product-video workflow, but it also installs silent self-updates and uses a broad shared credential that deserves review before use.

Review this before installing in sensitive environments. The creative workflow has useful safeguards around paid generation, but you should be comfortable with a shared Beatra token in ~/.beatra, broad Beatra account scopes, first-use registration metadata, and automatic package updates. Consider disabling auto-updates with the documented command and using a dedicated Beatra account if you want tighter blast-radius control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill exposes significant capabilities—environment access, file read/write, network, and shell—without declaring permissions or clearly constraining their use. That creates a trust gap where a host or user may approve a seemingly simple media skill while it can also access local state, run commands, and communicate externally.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior materially exceeds the advertised purpose: beyond generating a product video, it performs authentication, stores bearer credentials locally, uploads files, can call arbitrary remote tools through an MCP client, registers installs/telemetry, and manages uninstall/credential revocation. This mismatch is dangerous because users may consent under false assumptions, while the skill gains broad access to local and remote resources unrelated to the narrow stated task.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
Embedding a self-updating package mechanism in a skill whose business purpose is product-video generation expands the attack surface unnecessarily. Even if safeguards are described, remote update logic introduces a pathway for code changes after installation, which is unrelated to the core media workflow and increases supply-chain and integrity risk.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Automatic remote update with local file replacement is especially risky because it enables post-installation code changes on the user's system. In the context of a simple product-video skill, this capability is disproportionate and could be abused through a compromised upstream, flawed verification, or implementation bug to alter package-owned files without meaningful user review.

Description-Behavior Mismatch

Low
Confidence
86% confidence
Finding
The documentation describes an automatic installation-registration network call that sends package, version, platform, and installation reference data, which is outside the core purpose of generating product videos from a photo. Even if described as non-billable and best-effort, this creates telemetry-like behavior and expands data collection beyond what users would reasonably expect from the stated skill functionality.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
The file documents persistent tracking of the host environment via a stable external installation reference, platform resolution, and local cache files, none of which are clearly needed to transform a product image into a marketing video. This broadens the skill's ability to fingerprint deployments and correlate installations across time, increasing privacy risk if the data is misused or breached.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The OAuth scope string requests far more capability than the skill’s stated purpose of turning a product photo into a narrated product video. In particular it bundles unrelated read/write and task-control permissions, violating least privilege and increasing blast radius if the skill, its token, or downstream services are abused.

Context-Inappropriate Capability

Critical
Confidence
88% confidence
Finding
The scope includes tasks:cancel, which is not evidently required for creating a single finished product video from user inputs. Cancellation authority can disrupt other jobs under the same account and therefore increases cross-workflow impact if the credential is abused.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The scope includes tasks:cancel, which is not evidently required for creating a single finished product video from user inputs. Cancellation authority can disrupt other jobs under the same account and therefore increases cross-workflow impact if the credential is abused.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The scope includes tasks:cancel, which is not evidently required for creating a single finished product video from user inputs. Cancellation authority can disrupt other jobs under the same account and therefore increases cross-workflow impact if the credential is abused.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The scope includes tasks:cancel, which is not evidently required for creating a single finished product video from user inputs. Cancellation authority can disrupt other jobs under the same account and therefore increases cross-workflow impact if the credential is abused.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The file contains a full self-update subsystem that downloads manifests and archives and then rewrites files under the installed package root. Even though it includes integrity checks and rollback logic, this materially expands the skill's authority beyond its declared photo-to-video purpose and creates a persistent code-change path that could be abused if the update channel, signing assumptions, or hosting trust boundary are ever compromised.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The client records installation telemetry and a local skill inventory unrelated to the stated product-video function, including package slug, version, platform, install path, and timestamps. This increases privacy and tracking surface and can expose local environment metadata that users would not reasonably expect from a media-generation skill.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code fingerprints the host environment using environment variables and persisted host metadata to classify the agent platform. For a product-photo-to-video skill, this collection is not functionally necessary and creates unnecessary environment-identification and telemetry capabilities that become more concerning when combined with registration and inventory reporting.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill can silently perform automatic persistent updates during normal execution, changing local package files without an interactive approval step at runtime. In the context of a simple product-video generator, this is disproportionate capability and creates a stealthy persistence and code-replacement mechanism that could deliver new behavior after installation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The document states that the client silently checks for and automatically installs newer releases by default without separate confirmation. Even with integrity checks and pinned sources, automatic file replacement changes executable behavior without explicit user approval at update time, increasing supply-chain and trust-boundary risk if the update channel, signing process, or publisher account is ever compromised.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The markdown states that a client automatically makes a registration call on first use and transmits installation/environment metadata, but it does not present a clear user-facing warning or consent mechanism. Silent network transmission of device or environment-linked metadata can violate user expectations, privacy requirements, or enterprise deployment policies, especially because the skill's advertised purpose is unrelated to telemetry.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
maybe_auto_update() is invoked in normal command execution and suppresses exceptions, allowing local installation changes to happen silently and best-effort in the background. That lack of user-facing disclosure reduces transparency and makes it harder for users or defenders to understand why code changed, which is especially risky for a skill whose declared purpose is only media generation.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
96% confidence
Finding
The CLI explicitly exposes self-update functionality that can replace the installed package's files. In a skill advertised for turning product photos into videos, self-modification is outside expected scope and provides a durable pathway for post-installation code changes, increasing supply-chain and persistence risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.