talking-avatar-video

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:15 AM UTC
• Version: 0.1.9

Overview

This talking-avatar skill appears purpose-built for Beatra media generation, but it needs review because it uses a broad paid-account token and silently self-updates local package files.

Install only if you trust Beatra with a broad shared device token that can run paid Beatra operations and spend account credits. Before ordinary use, consider running the documented auto-update disable command, review the Beatra approval page carefully, and be aware that the skill writes persistent state under ~/.beatra and sends package/platform registration metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions while instructing use of a bundled Python client that can read local files, write/update package files, access environment-held credentials, invoke shell commands, and make network requests. This under-declaration is dangerous because users and hosting agents cannot accurately assess the trust boundary or enforce least privilege before the skill performs sensitive local and remote operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The public description presents the skill as a media-generation workflow, but the content also authorizes credential handling, generic remote tool invocation, local file upload, self-update, registration/telemetry, and uninstall behavior. That mismatch obscures materially different security-relevant behaviors, increasing the risk that a user or agent invokes the skill expecting simple video generation while unknowingly permitting code and account-affecting actions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This document describes a silent self-updating client that automatically installs newer releases, which is unrelated to a talking-avatar video skill and materially expands the skill's operational scope into software modification. A hidden updater creates a supply-chain and remote code execution risk if the update channel, package metadata, or distribution path is ever compromised, and the mismatch with the stated skill purpose makes the behavior more suspicious in context.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Automatically installing software updates without separate confirmation allows remote changes to local code and files without the user's informed consent. In the context of a media-generation skill, this capability is unjustified and increases the danger because users would not reasonably expect the skill to modify installed software, making abuse or compromise of the update path especially impactful.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The authorization scope is far broader than the stated purpose of a talking-avatar video skill. It requests unrelated privileges including artifacts access, image/video/music/speech generation, voice read/write, task control, and especially wallet spending, creating a substantial blast radius if the skill, token, or backend is abused or compromised.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Requesting wallet spending capability for a skill whose purpose is creating talking-avatar videos is unjustified and highly dangerous. If the credential is misused, an attacker or compromised skill could trigger billable actions or consume user funds without a clear functional need tied to the advertised feature set.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The script persists host platform, device name, skill install path, and local inventory metadata that are not clearly necessary for generating talking-avatar media. This creates unnecessary collection of local environment information and software inventory data, which can aid fingerprinting, privacy loss, or later targeting if the state directory is exposed.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The client includes broad non-core capabilities—self-update, installation registration, and local inventory tracking—that exceed the stated purpose of creating talking-avatar videos. Expanding scope increases attack surface and creates additional paths for network communication, persistence, and package modification that users may not expect from a media workflow skill.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code fingerprints the host environment via environment variables and local state, then injects source_platform and source_package_slug metadata into tool calls. This is dangerous because it leaks execution-context information unrelated to the video-generation task and can support tracking, profiling, or differential server behavior without clear necessity.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The client persistently records local skill inventory and performs installation telemetry unrelated to the creative task. This creates unexpected local tracking and outbound reporting, which increases privacy risk and broadens the impact of compromise or misuse beyond the advertised skill behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that ordinary use of the bundled client triggers silent update checks and may install a newer release without separate confirmation, modifying local package-owned files. Even with checksum verification, silent self-modification expands the attack surface and weakens user control, especially because the top-level skill description does not warn that running the workflow can change the local installation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file describes automatic download and replacement of package files but does not provide a prominent user-facing warning that the client will modify local software. Even if integrity checks exist, the lack of explicit warning undermines informed consent and increases the chance that users unknowingly permit risky system changes.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation states that the bundled client will automatically perform an installation registration call and write to a local cache, but it does not clearly warn users up front about this telemetry-like network activity and filesystem modification. Even though the data is described as non-secret and non-billable, silent outbound registration and persistent local state can violate user expectations, privacy requirements, or enterprise controls when performed automatically on first use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill can silently auto-update by downloading remote manifests and archives and replacing local package files during normal operation. Even with checksum and path validation, silent code replacement is high risk because it changes executable behavior without point-of-use user approval and creates a powerful supply-chain mechanism inside a skill whose declared purpose is media generation.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The presence of built-in self-modification/self-update capability is inherently dangerous in a skill because it permits remote code changes on the local system after installation. In this skill context, that capability is not necessary for producing talking-avatar videos and materially increases supply-chain and persistence risk if the update channel or publisher is ever compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.