rednote-carousel-maker

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:05 AM UTC
• Version: 0.1.2

Overview

The skill can make REDnote carousel images, but it also asks for broad Beatra account powers and silently updates its own installed files by default.

Install only if you are comfortable granting Beatra a persistent full-scope device token that can spend credits, use non-image media tools, upload selected local files, send package/platform registration data, and let this skill silently replace its own package files unless auto-update is disabled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares no permissions, yet its documented workflow requires network access, shell execution, file read/write, environment access, and local state management via a bundled Python client. This is dangerous because users and reviewers are not given an accurate permission boundary, making sensitive operations like credential storage, uploads, and local modifications less visible and less consent-driven.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The published description frames the skill as a carousel creator, but the actual behavior includes authentication, persistent credential storage, remote tool invocation, local uploads, telemetry/registration, uninstall cleanup, and self-update. That mismatch is security-relevant because users may authorize a creative tool without realizing it also installs software, changes local state, stores tokens, and communicates broadly with remote services.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes automatic self-update during normal command execution, which is unrelated to the core task of carousel creation and expands the trusted computing base at runtime. Even with stated verification, silent code replacement introduces supply-chain risk and can change behavior after initial review, potentially enabling malicious updates or accidental regressions to execute under the user's trust.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest advertises image/carousel generation, but the implementation also performs package update/install operations, which materially changes the risk profile of the skill. Users expecting content generation may unknowingly execute software-management actions that modify local files and future runtime behavior.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file documents behavior that causes the bundled client to make an outbound installation-registration call and maintain a local registration cache, which is unrelated to the declared carousel-generation purpose of the skill. Even though the data is described as non-billable and non-secret, hidden telemetry-like behavior expands data collection and network activity beyond user expectations for a creative image-post skill.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documented registration flow collects package slug, version, platform, and a stable external installation reference, and resolves the real agent environment from environment signatures or a host file. For a Xiaohongshu/REDnote carousel-making skill, this host/platform fingerprinting and persistent installation identification are unjustified and create privacy and tracking risk, especially because they occur on first use and are not required for image-sequence generation.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope string requests a very broad set of capabilities, including wallet spending, task control, and multimodal generation functions that are not necessary for a REDnote carousel/image creation skill. Excessive permissions violate least privilege and make any compromise, misuse, or backend abuse materially more damaging than the skill’s stated purpose requires.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The authorization flow includes spending and unrelated generation capabilities such as videos, music, speech, and voice management despite the package being described as a carousel maker. In this skill context, that mismatch is especially concerning because users would reasonably expect narrow image-related access, not broad account and billing-affecting privileges.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The client contains extensive self-update logic that downloads manifests and archives from remote infrastructure and then rewrites installed package files. Even though there are integrity checks, this capability materially exceeds the stated carousel-generation purpose and creates a software supply-chain and self-modification risk surface inside an end-user skill.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The code fingerprints the host agent environment using environment variables and local host metadata to classify the running platform. This is not necessary for generating image carousels and increases privacy risk while enabling behavioral tracking or environment-aware server logic.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill records local inventory data and sends installation registration telemetry to a remote service on use. For a carousel-making skill, persistent install tracking and local skill inventory maintenance are unnecessary to core functionality and create avoidable privacy and monitoring risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that automatic updates can install without separate confirmation during ordinary public commands, while the description does not clearly warn users that code may change during normal use. Silent code changes undermine informed consent and security review, and create a supply-chain window where trusted behavior can shift unexpectedly.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document states that the client silently checks for and automatically installs newer releases without separate confirmation, which means installed files and even the updater client itself may be modified without an explicit user action at update time. Even with checksum, origin, rollback, and path-safety controls, enabling automatic file replacement by default increases supply-chain and user-consent risk because users may not clearly understand that local binaries are being changed during ordinary command execution.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: maybe_auto_update() performs a silent background update check and, when available, downloads and applies code changes before the main command proceeds, without a contemporaneous user-facing warning. Silent code replacement is dangerous because it changes the local executable trust boundary and can introduce unreviewed behavior through a compromised update channel or unexpected release.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The upload path reads an arbitrary local file and transmits its contents to remote infrastructure after obtaining upload instructions, but this function itself provides no privacy warning, consent checkpoint, or path restriction. In a creative skill that may handle personal media, this can lead to inadvertent exfiltration of sensitive local files if invoked with the wrong path or through higher-level misuse.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The command surface explicitly exposes self-update functionality, and elsewhere in the file that functionality can replace files in the installed package. Self-modification significantly raises risk because the skill can alter its own behavior after deployment, which is especially concerning given the skill's unrelated business purpose.

Static analysis

No suspicious patterns detected.