AI Voiceover for Short Videos

• Outcome: Review
• Latest audit: Aug 20, 2026 · 8:09 AM UTC
• Version: 0.1.8

Overview

This voiceover skill needs review because it uses broad Beatra account access and silently updates its own files by default, beyond the narrow audio-generation task.

Review before installing. Use it only if you are comfortable granting a shared Beatra device token with broad media, wallet, artifact, and task permissions, and with automatic package updates being on by default. Consider disabling auto-updates with `python3 scripts/mcp_client.py update --auto off`, and revoke the device from Beatra Console or run the uninstall flow when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares a narrow voiceover purpose but documents capabilities spanning shell execution, filesystem access, network access, local state handling, and updates without any explicit permission declaration. This creates a hidden trust boundary: users may approve an audio workflow while the skill can also modify local files, store credentials, and contact remote services, increasing the risk of unauthorized code execution or data exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented behavior substantially exceeds the stated purpose of generating short-form voiceover audio by adding OAuth login, persistent credential storage, generic remote tool invocation, file upload, telemetry/registration, uninstall logic, and self-updating installation. This mismatch is dangerous because it can mislead users and reviewers about the real attack surface, allowing privileged operations to occur under the cover of a benign media-production workflow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: A skill presented as a voiceover workflow also includes package self-update and installation behavior, which is outside normal user expectations for media generation. Even with integrity-check claims, embedding updater logic in a content-production skill broadens the attack surface and enables code changes after initial review or approval.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Automatic self-update is unjustified for the stated task and allows the skill's executable behavior to change over time, potentially installing new code during ordinary use. This is especially risky because the update occurs silently by default, which undermines reviewability, stable trust assumptions, and user control over code execution.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation says the deliverable is audio only, then expands into installation, update, and account-management behavior, creating contradictory expectations about scope. That inconsistency can cause users to approve the skill for a limited media task while missing that it also performs system-level and account-level operations.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The authorization helper requests a very broad OAuth scope set, including images, videos, music, task control, artifact access, and wallet spending, while the skill is described as a short-form voiceover/audio workflow. This violates least privilege and expands blast radius substantially if the token is misused, stolen, or if downstream components behave unexpectedly.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The requested scopes include unrelated media generation and task-control capabilities that exceed the stated voiceover purpose. This creates unnecessary access to produce other asset types or manipulate tasks/artifacts, increasing the chance of misuse and making any credential compromise materially worse.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The requested scopes include unrelated media generation and task-control capabilities that exceed the stated voiceover purpose. This creates unnecessary access to produce other asset types or manipulate tasks/artifacts, increasing the chance of misuse and making any credential compromise materially worse.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The client implements substantial functionality unrelated to the advertised voiceover workflow, including package self-update and local state management. In the context of a creative media skill, this materially expands the trust boundary and attack surface by allowing code changes and persistence behaviors users would not reasonably expect from the manifest.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill records a local inventory of installed skills and performs installation registration telemetry that is not apparent from the voiceover-focused description. In this context, undeclared telemetry and device-local inventory collection increase privacy risk and create hidden tracking behavior beyond what is needed to generate or upload audio.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The code fingerprints the host environment via environment variables and host.json to derive a platform identifier. For a short-form voiceover skill, this is not functionally necessary for core audio generation and adds avoidable device-identification metadata that can support tracking or profiling.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that automatic updates are enabled by default and may install newer packages silently during normal command execution. Silent code installation without a prominent user-facing warning is dangerous because it permits post-review behavior changes and reduces the user's opportunity to assess new code before execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that the client silently checks for updates by default and automatically installs newer releases without separate confirmation. Even with integrity checks and fixed origins, this behavior materially changes local code without explicit user approval at install/update time, which expands the trust boundary and creates supply-chain risk if the update channel, signing process, or publisher account is ever compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation states that the client automatically sends installation metadata to a backend and writes a local cache file, but it does not clearly warn users beforehand or obtain explicit consent. Even if the data is described as non-secret and non-billable, silent telemetry and filesystem writes can violate user expectations, privacy requirements, or enterprise compliance policies.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code collects the local hostname via `socket.gethostname()` and sends it in the device authorization request without clear user-facing notice. While not an exploit by itself, hostnames often contain personal or enterprise-identifying information, so transmitting them silently creates avoidable privacy leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client can silently auto-update itself and replace local package files during normal command execution without a contemporaneous user warning. Even with checksum and manifest validation, this creates a supply-chain risk because a creative tool unexpectedly gains the ability to mutate its own codebase and behavior over the network.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The skill exposes self-update capability that can modify its own installed code, which is a high-risk primitive even if intended for maintenance. In the context of a voiceover tool, self-modification is more dangerous because it is outside the user’s expected task scope and can turn a benign content tool into a moving supply-chain target.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.