REDnote Local Business Note Maker

• Outcome: Review
• Latest audit: Aug 20, 2026 · 1:34 PM UTC
• Version: 0.1.1

Overview

The skill mostly does what it advertises, but it also installs a broad Beatra authorization, persistent local state, telemetry, and silent self-updates that deserve review before use.

Before installing, review whether you are comfortable granting a shared Beatra device token with broad media and wallet-spend scope, allowing selected local files to be uploaded to Beatra, sending installation/platform registration data, and accepting silent package updates unless you disable them with the documented update command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares itself as a content-generation tool, but the documented behavior includes shell, network, file read/write, environment access, and use of a bundled client for remote operations without any declared permissions boundary. That creates an unexpectedly broad execution surface where local files, credentials, and network interactions may occur under a benign-seeming skill, increasing the chance of data exfiltration or unauthorized system changes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior materially exceeds the advertised purpose: in addition to making REDnote posts, it performs OAuth login, stores credentials in ~/.beatra, uploads local files, talks to arbitrary Beatra tools through an MCP client, registers installations, and supports update/uninstall flows. This mismatch is dangerous because users may grant trust and provide files under the assumption of simple media generation, while the skill actually introduces persistent authentication, telemetry, remote execution reach, and local state modification.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill includes self-updating installation behavior unrelated to its primary task of creating social-media note content. Even with integrity-check language, embedding updater logic into a content skill expands the attack surface and enables code changes after installation, which can alter trust assumptions over time.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Automatic remote update plus local file replacement is not justified by the stated purpose of generating REDnote business visuals and introduces a software supply-chain risk. Any compromise of the update channel, signing/verification process, or trusted endpoints could result in silent modification of locally installed files and persistent execution of attacker-controlled code.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documentation describes an automatic outbound installation registration flow that is unrelated to the advertised purpose of generating local-business social content. Even if the transmitted fields are framed as non-secret, this creates undeclared telemetry behavior and expands the skill's operational scope beyond user expectations, which is risky in a content-generation package.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The file states that the package collects and transmits platform and stable installation reference metadata, which is not justified by the skill's stated image-to-post creation purpose. This kind of host/environment fingerprinting can support tracking, correlation of installations, or future expansion of telemetry without clear user need.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The OAuth scope requests far more privileges than are necessary for a skill whose stated purpose is generating REDnote/Xiaohongshu business-note content. In addition to image generation, it asks for videos, music, speech, voice read/write, artifact/task control, and wallet spending, creating a clear least-privilege violation that would let the skill or any compromised downstream component access unrelated paid or sensitive platform capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script derives host platform information from environment variables and a device-recognizable hostname, then persists it locally for later use even though that data is not needed to create local-business posts. This expands the amount of endpoint metadata associated with the authorization state and can aid fingerprinting, correlation across installs, or privacy-invasive inventorying if the state directory is later accessed by another component.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The authorization flow records a local inventory of installed skills, including slug, platform, and resolved filesystem install path, despite the package being described as a content-generation skill rather than a device-management tool. Maintaining this inventory creates unnecessary local surveillance of the user's environment and exposes sensitive path information that could reveal usernames, workspace names, or deployment layout if accessed by another process.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The client includes substantial behavior unrelated to the advertised content-creation purpose: package self-update, installation registration, inventory tracking, and local state management. This broadens the trust boundary and gives the skill code authority to modify itself and maintain persistent device state, which increases supply-chain and privacy risk far beyond what a user would expect from a note-generation skill.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code fingerprints the host environment via environment variables and host.json, records local inventory, and transmits installation telemetry such as platform and installation references. In a local-business note maker, this data collection is unrelated to core functionality and creates unnecessary privacy exposure and potential user/environment profiling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that newer releases install automatically without separate confirmation, but this local-modification behavior is not prominently disclosed in the skill's user-facing description. Silent changes to installed code undermine informed consent and make a benign content skill materially more dangerous because its behavior can change after users initially trust it.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document states that the client silently checks for updates by default and automatically installs newer versions without separate confirmation. Even though later text describes integrity checks and rollback protections, silently modifying a local installation without explicit prior consent expands the trust boundary and can surprise users, which is a legitimate security and safety concern.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation describes first-use network transmission and writes to a local cache file without an explicit user warning or consent mechanism. Silent data transmission and filesystem modification undermine transparency and can violate user trust, enterprise policy, or sandbox assumptions even if the operation is described as best-effort and non-blocking.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: Host metadata is written to disk on a best-effort basis without any user-facing disclosure in this file. While not directly enabling code execution, silent persistence of environment-derived metadata undermines transparency and can contribute to privacy harm when combined with other local state.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The script silently writes a skills inventory containing install paths and related metadata without warning the user. Even though the data remains local, undisclosed collection of software inventory information is unnecessary for the advertised note-making function and weakens user trust and privacy posture.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code performs silent automatic update checks and can download and overwrite installation files during ordinary execution, without contemporaneous user-facing disclosure. Even with checksum and path validation, this creates a powerful supply-chain/self-modification channel in a skill whose stated purpose does not require code mutation at runtime.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The upload flow reads a local file and transmits its contents to a remote service after obtaining an upload grant, but the flow itself provides no user-facing warning about exfiltration at execution time. In a tool handling storefront photos and merchant materials, silent remote transfer of local files can expose sensitive business images or documents if the caller misunderstands where data is sent.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 83% confidence
• Finding: The script stores a bearer access token in plaintext JSON under the user's home directory, and the token carries broad scopes including wallet spending and multiple generation/task capabilities. Although file permissions are restricted, any local compromise of the user account, backup leakage, or permissive platform behavior would expose a reusable high-privilege credential.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 78% confidence
• Finding: The script reads an access token from ~/.beatra/credentials.json and uses it to perform remote revocation, which is legitimate uninstall behavior but still constitutes sensitive credential access. This becomes risky because any code execution in the skill can access bearer tokens from a shared location, and compromise of that token could allow unauthorized actions against the associated Beatra device authorization.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The presence of a self-update capability means the skill can intentionally replace its own installed code. In the context of a content-generation skill, self-modification is especially sensitive because it enables behavior changes after install and increases the blast radius of any backend or distribution compromise.

Static analysis

No suspicious patterns detected.