video-generation-studio

• Outcome: Review
• Latest audit: Aug 21, 2026 · 6:55 AM UTC
• Version: 0.1.4

Overview

The skill is mostly a disclosed Beatra video workflow, but it also requests broad account permissions and silently self-updates local package code by default.

Install only if you are comfortable granting Beatra a broad shared device token, including wallet spending and non-video media scopes, and with automatic package updates being enabled by default. Consider disabling auto-updates with `python3 scripts/mcp_client.py update --auto off`, review Beatra account/device revocation controls, and avoid uploading sensitive local media unless you intend to send it to Beatra.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while explicitly instructing use of local file access, shell execution, network calls, environment/auth handling, and package modification behavior through the bundled client. This creates a transparency and consent problem: operators may invoke a skill believing it is low-risk, while it can access local media, upload it remotely, manage credentials, and modify installation files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is video generation, but the skill also performs credential acquisition/storage, session management, telemetry/registration, local artifact upload, uninstall cleanup, and self-update/self-replacement. That mismatch is dangerous because users and policy engines may authorize the skill for creative media work without realizing it also persists credentials, communicates with additional services, and changes local software state.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill embeds a self-updating installer path that downloads and replaces package-owned files, which is unrelated to the core task of generating videos. Even with stated verification controls, self-update materially increases attack surface: compromise of the update channel, validation logic, or package ownership boundaries could lead to arbitrary local code replacement under the user's trust context.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The requested OAuth scope set is far broader than the skill's stated purpose of video generation and editing. In addition to video and artifact access, it requests image, music, speech, voice management, task control, and wallet spending permissions, which violates least privilege and materially increases blast radius if the credential is abused or stolen.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The authorization request includes voices:read and voices:write, which are not justified by the skill description centered on AI video creation. Unnecessary voice-management permissions expand access to unrelated resources and increase the consequences of token misuse or compromise.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The authorization request includes voices:read and voices:write, which are not justified by the skill description centered on AI video creation. Unnecessary voice-management permissions expand access to unrelated resources and increase the consequences of token misuse or compromise.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The file implements a full self-update and package-management system, including remote discovery, download, validation, and replacement of installation files, which is outside the stated purpose of a video-generation skill. Even with integrity checks, this materially expands the trust boundary: routine skill execution can lead to code replacement on disk, creating persistent compromise risk if the update channel, publisher account, or signing workflow is ever abused.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The client records local skill inventory and sends installation-registration telemetry that is not necessary for generating or editing videos. This creates privacy and tracking risk by persisting install paths, platform identity, timestamps, and external installation references, and it does so on routine use rather than a narrowly scoped opt-in analytics flow.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code fingerprints the host environment using environment variables and local state, then injects source_package_slug and source_platform into business tool calls. For a video-generation skill, this metadata is not obviously required and enables unnecessary environment profiling and cross-request attribution that can reduce user anonymity and expand backend tracking.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill states that newer releases install without separate confirmation during ordinary commands, but it does not require a prominent runtime warning when a user is about to run a command that may mutate local package files. Silent modification undermines informed consent and can surprise users or administrators who intended to run a media task, not authorize local software changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly states that the client silently checks for updates and automatically installs newer releases by default without separate confirmation. Even with checksum verification and fixed update sources, this behavior modifies local code implicitly and can surprise users, increasing supply-chain and operational risk if the update channel, signing process, or release pipeline is ever compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The recipe explicitly instructs users to inspect and upload local media to a remote artifact transport service, but it does not include any warning about sensitive content, consent, retention, jurisdiction, or data-handling implications. In a video-generation workflow, source media commonly contains faces, voices, interiors, products, or client assets, so omitting a privacy/security warning materially increases the risk of accidental exfiltration of confidential or personal data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs silent automatic updates as a best-effort background action before normal commands, downloading remote content and overwriting local installation files without user-facing notice at execution time. In the context of a media-generation skill, this is especially dangerous because ordinary creative use implicitly triggers persistence-changing behavior unrelated to the requested task.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: A skill runtime exposing self-modification capability is a real security concern because it allows code on disk to be replaced from network-fetched content. Although the updater includes several safety checks, self-modifying behavior is not necessary for the advertised video-generation function and increases persistence and supply-chain risk if the update source is compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.