REDnote Beauty Note Maker

• Outcome: Review
• Latest audit: Aug 20, 2026 · 9:57 AM UTC
• Version: 0.1.1

Overview

This beauty copywriting skill is mostly disclosed, but it asks for and manages much broader Beatra account authority than its text-planning purpose needs.

Review before installing. This is not just a beauty-note prompt pack: it can connect your agent to Beatra with a broad shared device token, register this installation, upload local files when invoked, call generic Beatra tools, and silently replace its own package files unless automatic updates are turned off. Only install if you trust Beatra with those account and local-package privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill presents itself as a beauty copywriting tool, yet the documentation indicates capabilities consistent with code execution, file access, environment access, and network communication. This violates least privilege and creates a materially larger attack surface, especially because users would not reasonably expect a content-writing skill to access local state or invoke external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: There is a major description-behavior mismatch: a skill advertised as generating Xiaohongshu beauty notes also performs authentication flows, persistent credential storage, remote tool invocation, file uploads, telemetry/registration, uninstall behavior, and self-updating. This is dangerous because users may provide trust and local access under false expectations, enabling credential capture, data exfiltration, arbitrary remote action through MCP tools, and host modification unrelated to the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documentation grants the package silent automatic update and self-replacement behavior, which is unrelated to generating beauty notes and modifies the local installation without separate confirmation. Even if integrity checks exist, this establishes a supply-chain and persistence mechanism that can change executable behavior after installation, increasing the risk of abuse if the update channel or publisher is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest describes a non-billable text-planning skill, but the documentation instructs use of an external bundled client with installation, registration, and authentication behavior. This hidden expansion from local content drafting into external client execution and service onboarding is a security-relevant mismatch that can expose credentials, local files, and system state without appropriately informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation states that one approval grants access to image, video, music, speech, upload, model, and task tools, which is far broader than the skill's stated beauty-note-making purpose. This violates least privilege and creates an unnecessary expansion of the attack surface: a compromised or overly capable skill could invoke unrelated remote capabilities under a single authorization.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The bundled MCP client is documented as a generic remote tool interface supporting tool discovery and arbitrary tool invocation, rather than a fixed-function beauty-note workflow. Exposing tools/list and tools/call in a user-facing skill materially increases the chance of misuse, capability abuse, or prompt-driven invocation of unrelated backend actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Granting access to unrelated multimedia and task capabilities is unjustified for a beauty-note content generator and suggests overbroad backend authority. If exploited, this could enable actions far outside the user's expectations, including media processing or uploads unrelated to the declared skill function.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script requests an unusually broad OAuth scope set, including wallet spending and multiple content-generation capabilities, which is far beyond what a beauty note creation skill appears to need. If the credential is later abused or the backend service misuses granted scopes, the user has authorized materially more power than necessary, violating least privilege.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The authorization flow detects platform/environment information and device hostname, then persists and may transmit that metadata during authorization. For a beauty content skill, collecting host identity data is not obviously necessary and increases privacy risk, especially if users are unaware it is being sent or stored.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script records a local inventory of installed skills and absolute install paths in ~/.beatra/skills.json, which exceeds the apparent needs of generating beauty notes. This creates unnecessary privacy and system reconnaissance data that could expose user environment details if accessed by other software or through compromise.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The client implements a full self-update mechanism that downloads manifests and archives from remote infrastructure, validates them, and then rewrites files in the local installation directory. Even with integrity checks, this materially expands the trust boundary and gives a beauty-content skill the ability to modify its own codebase, which is unrelated to the stated purpose and raises supply-chain and persistence risk.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code records local skill inventory and sends installation registration telemetry including package slug, version, platform, and external installation reference. This exceeds the minimum needed for beauty-note generation and creates privacy and tracking exposure by maintaining device-local inventory and backend-visible installation metadata.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The client inspects environment variables and local host metadata to classify the surrounding agent platform, then uses that classification in requests and telemetry. For a beauty-note generator, this host fingerprinting is not functionally necessary and increases privacy and profiling risk by exposing execution-environment details to the remote service.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This uninstall script performs revocation of a shared device authorization and deletes shared state under ~/.beatra, which is unrelated to the skill’s stated purpose of generating beauty/skincare content. Even though the code is cautious, it still has the ability to affect other installed skills and a user’s broader agent environment, so a compromised or unexpectedly invoked uninstall path could cause denial of service or account/session disruption.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code issues a network request to revoke an OAuth device token, a capability that is not justified by a beauty note generation skill. This introduces a sensitive account-affecting action into a content skill package; if abused or triggered unexpectedly, it can disconnect the user from the service and impact other skills sharing the same authorization.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Automatic updates without separate confirmation are not prominently disclosed in the primary skill description, so users may install a benign-seeming writing tool without realizing it can later modify itself. In this skill context, that hidden system-modifying behavior is more dangerous because it is unrelated to the expected task and can materially alter trust assumptions after installation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document states that the client silently checks for updates by default and automatically installs a newer version without separate confirmation. Even though the text describes integrity checks and fixed update sources, silently replacing installed files changes executable behavior without explicit user approval at the time of update, which creates supply-chain and user-consent risk if the update channel, signing process, or hosting is ever compromised.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script asks users to approve broad, high-impact scopes but its user-facing messaging only mentions generic authorization and 'Allow', without clearly warning about sensitive powers like wallet spending or media generation. Users may consent without understanding the real privilege level being granted.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script derives host platform details from environment variables and captures a device name from the hostname, then uses that information in the authorization flow without explicit notice. While not directly enabling compromise, it is undisclosed metadata collection unrelated to the visible beauty-note purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: maybe_auto_update() performs silent background update checks and can apply code changes before executing the requested command, without a contemporaneous user warning or approval. In the context of a beauty-content skill, hidden code mutation is especially concerning because users would not expect a creative tool to change installed binaries on its own.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

• Confidence: 88% confidence
• Finding: The manifest explicitly references a local credential file used for device-bearer authentication to a remote MCP endpoint. While this is common for authenticated integrations, exposing or relying on a fixed credential path increases the risk of token misuse if the runtime, logs, prompts, or downstream tooling can access local files or inadvertently disclose configuration details.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 90% confidence
• Finding: Referencing credentials.json as part of the files eligible for deletion indicates the script manages shared authentication material. In this skill context, access to shared credential state is more dangerous because the package’s advertised function does not require credential handling, and deletion of that file can break unrelated skills or sessions.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 94% confidence
• Finding: The _device_token function reads an access token from credentials.json so it can be used for remote revocation. Reading bearer tokens inside a content-generation skill unnecessarily expands the trust boundary: if the package is modified or repurposed, that token access could be abused for unauthorized API actions or session disruption.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The exposed self-update command explicitly enables self-modification of the installed package, including replacement of local files from remotely downloaded artifacts. Self-modifying behavior is high risk in a user-facing skill because compromise of the update channel, signing process, or service trust model would let an attacker persist new code locally.

Static analysis

No suspicious patterns detected.