taobao-main-video-maker

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:15 AM UTC
• Version: 0.1.4

Overview

This skill is a disclosed Beatra product-video tool, but it asks for broad account authority and silently self-updates installed code by default.

Review before installing if you are uncomfortable with a Beatra skill storing a broad reusable local token, registering installation metadata, uploading selected product media to Beatra, or silently updating its own package files. Disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if you install it and want changes to require manual action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs use of shell execution, network access, local file reads/writes, and environment interaction via a bundled client, yet no permissions are explicitly declared. That creates a transparency and consent gap: a host or reviewer may underestimate the skill's access, while the skill can upload local files, store state, and modify package-owned files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is a narrow ecommerce video-making workflow, but the skill also encompasses authentication flows, persistent credential storage, generic remote tool invocation, uploads, telemetry/registration, uninstall behavior, and automatic update/install mechanisms. This mismatch weakens informed consent and broadens the attack surface, especially because users may provide product media believing the skill is limited to creative generation rather than credentialed remote operations and local system changes.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The requested OAuth scope set is far broader than the skill’s stated purpose of making Taobao/Tmall product videos. In addition to video generation, it requests wallet spending, task control, artifacts read/write, image/music/speech generation, and voice permissions, creating an over-privileged shared credential that could be abused if the skill or its environment is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The authorization flow records host platform, device name, install path, and local skill inventory data that are not clearly necessary for a product-video skill. This expands collection of environment metadata and creates a device-local inventory of installed skills, increasing privacy risk and exposing contextual information useful for profiling or targeting if local state is accessed.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The client contains a full self-update and package replacement subsystem that can silently download, validate, and overwrite local installation files, which is unrelated to the stated purpose of creating ecommerce product videos. Even with checksum and path validation, this materially expands the trust boundary: a compromise of the vendor update channel, signing process, CDN/discovery control plane, or package publisher could turn the skill into a remote code delivery mechanism.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill records installation telemetry, registration state, and local skill inventory beyond what is needed to generate product videos. In the context of a creative media skill, this extra collection increases privacy and surveillance risk and creates additional local state that could be abused to profile usage, correlate installations, or support later intrusive behavior.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the host environment via environment variables and cached host metadata to classify the platform initiating requests. For a Taobao/Tmall product video maker, this is not obviously necessary and increases privacy risk by enabling environment correlation and user/toolchain tracking across requests and registrations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Maintaining a local installation inventory of skills and paths is outside the expected behavior of a product video generation tool. In this skill context, such tracking is more suspicious because it broadens visibility into the user's local environment and can support uninstall-side effects, telemetry correlation, or future policy enforcement unrelated to the media task.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill enables silent automatic updates that replace local files without upfront warning in the top-level description. Even with claimed verification checks, auto-modifying executable/package files materially increases supply-chain and unexpected-code-execution risk, particularly when updates occur without a clear opt-in at install/use time.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation, which creates a software supply-chain risk and removes meaningful user consent for file replacement on their system. Even though the text describes integrity checks and rollback protections, default silent self-updating still increases the blast radius of any compromise of the update infrastructure, signing/checksum process, or release pipeline.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The documentation states that the client performs an automatic installation registration call and writes a local cache file, but it does not clearly warn users up front that metadata will be transmitted externally and persisted on disk. While the transmitted fields are described as non-secret and the call is non-billable, silent telemetry and filesystem writes can create privacy, compliance, or trust issues if users are unaware of them.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The maybe_auto_update() path performs best-effort silent updates and can modify installed package files during normal execution without prompting the user at runtime. In a skill whose advertised purpose is only video creation, undisclosed file mutation reduces user control and can be used to introduce new behavior before the user has a chance to review changes.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 82% confidence
• Finding: This code writes a long-lived bearer access token to a plain JSON file in the user’s home directory, creating a reusable local secret outside an OS credential manager. If the file is exposed through local compromise, backup leakage, or weak platform ACLs, an attacker can reuse the over-scoped credential to access Beatra services under the user’s account.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: Exposing self-update functionality in the CLI confirms the package is designed to modify its own installed code. In the context of a product video maker, self-modification is not intrinsic to the claimed business function and creates a high-impact code supply-chain risk if the update path, publisher account, or remote infrastructure is compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.