product-video-studio

• Outcome: Review
• Latest audit: Oct 12, 2026 · 2:49 PM UTC
• Version: 0.2.0

Overview

This skill is mostly coherent for making paid Beatra product videos, but it grants and exercises broad account authority with weak executable guardrails.

Review this carefully before installing. It can use a Beatra Device Token stored in ~/.beatra, spend account credits, register local installation details, silently update its own package files unless disabled, and revoke/delete shared Beatra connection state through its uninstall script. Install only if you trust Beatra's account, billing, and update channel, and consider disabling automatic updates with the documented update command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mcp_client.py:2299

Finding

Paid MCP Operations Lack an Enforceable User-Approval Gate

Content

View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:2299-2317, scripts/mcp_client.py:2382-2384
Vulnerability Type: Missing authorization enforcement for chargeable operations
Risk Level: High

Relevant Code:

python

def _run_command(
    command: str,
    tool_name: str | None = None,
    arguments: dict[str, Any] | None = None,
) -> dict[str, Any]:
    session = _session_with_registration(
        state_dir=Path.home() / ".beatra",
        post_json=_default_post_json,
    )
    if command == "tools":
        return session.request(2, "tools/list", {})
    if arguments is None:
        arguments = _read_tool_arguments()
    assert tool_name is not None
    return session.request(
        2,
        "tools/call",
        {"name": tool_name, "arguments": arguments},
    )

python

call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin")
call.add_argument("tool_name")

Technical Analysis

The bundled client accepts an arbitrary MCP tool name through a command-line argument and an arbitrary argument object through standard input. It then forwards both through an authenticated tools/call request without distinguishing read-only tools from paid or state-changing tools.

The authorization scope declared in scripts/authorize.py:43-46 includes wallet:spend, media-generation, write, and task-cancellation capabilities. Consequently, possession of the existing Device Token gives this generic call path access to operations capable of consuming credits or changing remote state.

The Skill documentation establishes two explicit user-approval stages before paid generation. In particular, references/workflow.md:120-123 states that approved preparation does not authorize video generation and that submission must wait until the user confirms sufficient credits or a top-up. These controls are only prose instructions. The executable ...[truncated 2016 chars]

Remediation

View remediation

Remediation Suggestions

1. Classify all supported MCP tools as read-only, free state-changing, paid, or destructive.
2. Reject paid and destructive tools in the generic call path unless an executable approval check succeeds.
3. Before approval, generate a canonical representation and cryptographic digest of the exact tool name, model, artifacts, duration, estimated maximum charge, and other request arguments.
4. Require a short-lived approval receipt bound to that digest, the authenticated installation, and a single client_request_id.
5. Reject the request if any argument differs from the approved payload or if the receipt is expired or already consumed.
6. Restrict this Skill to an explicit allowlist of required Beatra tools rather than forwarding arbitrary tool names.
7. Keep read-only discovery and balance operations separate from spending operations.
8. Add tests proving that direct paid calls fail without approval, changed payloads invalidate approval, and preparation approval cannot authorize a video request.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/uninstall.py:168

Finding

Uninstall Defaults to Credential Revocation and State Deletion Without Executable Confirmation

Content

View full analysis

Vulnerability Details

File Location: scripts/uninstall.py:168-173, scripts/uninstall.py:240-269, scripts/uninstall.py:278-287
Vulnerability Type: Missing confirmation for destructive credential and state removal
Risk Level: Medium

Relevant Code:

python

def uninstall(
    *,
    state_dir: Path | None = None,
    skill_root: Path | None = None,
    post_revoke: PostRevoke = _default_post_revoke,
    dry_run: bool = False,
) -> dict[str, Any]:
    """Apply the last-skill rule and return a machine-readable decision."""

python

    if dry_run:
        result.update({"decision": "disconnected", "revoked": False, "reason": "dry_run"})
        return result
    token = _device_token(state_dir)
    revoked = False
    revoke_state = "no_credential"
    if token is not None:
        try:
            status = post_revoke(token, _revoke_url(state_dir))
            if status == 200:
                revoked = True
                revoke_state = "revoked"
            elif status == 401:
                revoke_state = "not_recognized"
            else:
                result.update(
                    {
                        "decision": "revoke_retry",
                        "revoked": False,
                        "reason": f"http_{status}",
                    }
                )
                return result
        except RuntimeError:
            revoke_state = "unreachable"
    token = None
    _remove_local_state(state_dir)
    result.update({"decision": "disconnected", "revoked": revoked, "reason": revoke_state})
    return result

python

    parser.add_argument(
        "--dry-run",
        action="store_true",
        help="Report the decision without revoking or changing any file.",
    )
    args = parser.parse_args()
    result = uninstall(dry_run=args.dry_run)

Technical Analysis

The uninstall fu ...[truncated 2416 chars]

Remediation

View remediation

Remediation Suggestions

1. Make non-destructive preview behavior the default.
2. Require an explicit confirmation option, such as --confirm-disconnect, before revocation or file removal.
3. Bind confirmation to a recent dry-run result containing the package path, inventory state, remaining-Skill count, and intended files.
4. Refuse execution if the inventory or relevant state changes between preview and confirmation.
5. Clearly display whether the operation will revoke the server-side token, remove local state, or only remove the package.
6. Consider requiring an interactive typed confirmation when a terminal is available, while retaining a secure, explicit confirmation token for non-interactive Agent execution.
7. Add tests proving that invocation without confirmation cannot contact the revocation endpoint or remove files.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the package can perform uninstall, local credential/state deletion, token revocation, and inventory management despite being presented as a product-video generator, that is a serious behavior mismatch. Such hidden destructive or account-affecting operations could be triggered under the guise of normal media work, leading to loss of local state or disruption of shared authentication.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the package can perform uninstall, local credential/state deletion, token revocation, and inventory management despite being presented as a product-video generator, that is a serious behavior mismatch. Such hidden destructive or account-affecting operations could be triggered under the guise of normal media work, leading to loss of local state or disruption of shared authentication.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the package can perform uninstall, local credential/state deletion, token revocation, and inventory management despite being presented as a product-video generator, that is a serious behavior mismatch. Such hidden destructive or account-affecting operations could be triggered under the guise of normal media work, leading to loss of local state or disruption of shared authentication.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 71)May include surrounding context.

json

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 53)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 12)May include surrounding context.

md

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 430)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 1009)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1612)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 39)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 121)May include surrounding context.

python

The host follows this computer's network route, described below.

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The requested OAuth scope is far broader than necessary for a product-video generation skill, including wallet spending plus images, music, speech, voices, tasks, and artifact capabilities. If the credential is misused, compromised, or reused by another local skill, it could authorize unexpected spending and broad access well beyond the user's likely expectations for this skill.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The presence of a built-in self-update command confirms that the skill can modify its own installed code. In the context of a narrowly described ecommerce video skill, self-modifying behavior is significantly more dangerous because it enables post-install capability changes and creates a direct dependency on remote update trust, which can be abused if infrastructure, signing, or release controls fail.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 2396)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though it directs use of shell, network, file access, and environment-capable tooling. Without a restrictive allowlist, a host may grant broader capabilities than users expect, increasing the blast radius if the skill is abused or if bundled tooling behaves unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes automatic self-updating package behavior unrelated to the core task of generating a product video. Even with stated verification checks, runtime self-update expands the trust boundary and introduces supply-chain risk because code may change after review, potentially gaining new behavior without fresh user scrutiny.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The changelog states that users in mainland China will connect through a mainland-specific network path, with no indication of explicit user opt-in, transparent routing disclosure, or locale-based consent controls. Region-specific routing can expose users to different monitoring, legal, or data-handling regimes, making this a real security and privacy concern even though it appears to be described as a product change rather than an overtly malicious action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document explicitly states that the client silently checks for and automatically installs newer releases without separate confirmation. Even with integrity checks and rollback protections, silent self-updating changes local files and executable behavior without an explicit user action at install time, which creates supply-chain and user-consent risk if the update channel, signing process, or package ownership assumptions are ever bypassed or misconfigured.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · references/copy-craft.md (reported line 19)May include surrounding context.

md

## Length is a budget, and it is spent before you know the price

The finished video runs at most 15 seconds, and the video cannot be shorter than the narration without cutting the last words off. But the narration's real duration is only known after it is synthesized and paid for.

So write to about **12 seconds**, not to the ceiling. In Simplified Chinese that is roughly 55 to 60 characters; in English, a little over a sentence. The three-second reserve absorbs the difference between how you imagine the line and how the voice actually says it.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 106)May include surrounding context.

md

- say prominently that a signed-out browser lands on Beatra sign-in first:
  the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
  ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
  in [MCP connection](mcp-connection.md#network-route).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 132)May include surrounding context.

md

Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.

## Use the bundled MCP client

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script records host platform, device name, installation path, and maintains a shared local skill inventory under ~/.beatra, behavior not disclosed by the skill's user-facing purpose. While not inherently malicious, this creates undisclosed device-level persistence and cross-skill state that expands the trust boundary and could facilitate tracking or coupling between separate skills on the same machine.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The client implements capabilities far beyond the advertised product-video function, including self-update, installation registration, and local inventory persistence. In an agent skill, undisclosed code that can alter its own installation and maintain device-local state materially expands the trust boundary and creates supply-chain and persistence risk if the vendor service or update channel is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

maybe_auto_update() performs silent automatic update checks and, when available, downloads and replaces installation files before proceeding with normal commands, while suppressing errors and without user-facing notice at execution time. Silent self-modification in a skill increases supply-chain risk and undermines user expectations, because future behavior can change without explicit approval or review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.