short-video-bgm-studio

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:09 AM UTC
• Version: 0.1.5

Overview

The skill appears to be a real Beatra background-music generator, but it asks for broader account authority and silently updates its own installed files by default.

Review this before installing if you are not comfortable granting Beatra a shared token that can spend credits and access multiple media tools beyond music. If installed, disable silent package updates with `python3 scripts/mcp_client.py update --auto off`, use a Beatra account with appropriate spending limits, and only upload reference audio you intend to send to Beatra.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises a narrow music-generation function but exercises broad capabilities including shell, filesystem, environment, and network access without declaring permissions. That combination increases the blast radius of compromise and prevents informed consent or policy enforcement by the host, especially because the skill also performs remote operations and local file changes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: There is a substantial mismatch between the stated purpose and the actual behavior: credential handling, remote tool invocation, telemetry/registration, file upload, uninstall logic, and self-update machinery go well beyond generating background music. This is dangerous because users and security controls may trust the benign description while the skill gains durable access, modifies local state, and invokes broader remote functionality.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill includes automatic self-update that downloads and replaces package-owned files, which is unrelated to the core user request and creates a software supply-chain modification path. Even with claimed verification, silent code replacement materially increases risk because compromise of the update channel, signing process, or package logic would result in local code execution changes without contemporaneous user review.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file describes a bundled client that silently checks for, downloads, and installs software updates before ordinary commands, which is outside the stated purpose of a background-music generation skill. Even with integrity checks described, unsolicited self-update behavior expands the trust boundary to code execution and filesystem modification, creating supply-chain and unauthorized system-modification risk if the update mechanism or its hosting is ever compromised.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Silent automatic installation is especially risky because it modifies local files without contemporaneous user approval and is not necessary for generating background music. A compromised discovery endpoint, signing/checking flaw, or implementation bug could turn this into remote code delivery through an apparently benign creative tool.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The requested OAuth scope is far broader than this skill’s advertised purpose of generating short-video background music. It includes unrelated capabilities such as artifacts write/read, images/video/speech generation, voices read/write, task control, and wallet spending, which violates least privilege and would give the skill far more authority than users would reasonably expect.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The authorization scope grants multiple unrelated media-generation capabilities beyond background music, including image, video, speech, and voice operations. In the context of a music-only skill, these extra permissions expand the blast radius of any misuse, compromise, or confused-deputy behavior without providing a clear functional justification.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The authorization scope grants multiple unrelated media-generation capabilities beyond background music, including image, video, speech, and voice operations. In the context of a music-only skill, these extra permissions expand the blast radius of any misuse, compromise, or confused-deputy behavior without providing a clear functional justification.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill includes a full self-update and installation-management subsystem that can download archives from remote infrastructure and replace local package files. Even though it performs checksum and path validation, this behavior materially exceeds the declared short-video music-generation purpose and creates a persistent remote code modification channel inside the agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code records local skill inventory, host platform, installation references, and registration telemetry unrelated to generating background music. This expands data collection and tracking surface in a creative tool, potentially exposing environment metadata and install history without a clear user-necessary purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that newer releases install automatically without separate confirmation, yet does not require a user-facing warning at the moment local package files are changed. Silent modification of executable skill content undermines trust, can bypass change review, and compounds the danger of any compromise in the update pipeline.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document normalizes automatic installation and file replacement without a strong upfront warning that the software will alter the local installation automatically. That weak disclosure undermines informed consent and can cause users to run a media-generation skill without realizing it has persistent system-modifying behavior.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The documentation states that the bundled client automatically performs an installation registration call and transmits package and environment metadata, but it does not clearly warn users up front that outbound telemetry occurs on first use. Even though the data described is limited and non-secret, silent transmission of installation and platform identifiers can create privacy, compliance, and user-consent issues, especially in enterprise or regulated environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: maybe_auto_update() performs silent best-effort updates during normal command execution and suppresses exceptions, so local code may change without a clear execution-time warning to the user. In an agent skill, silent mutation of installed code reduces auditability and can turn a benign tool into a moving trust boundary.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The exposed CLI advertises self-update as a first-class capability, confirming that the package is designed to modify its own installed code. In the context of a music-generation skill, self-modification is unusually dangerous because it enables functionality drift and remote code replacement beyond the narrow task users believe they are invoking.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.