AI Video Realism Retoucher

• Outcome: Review
• Latest audit: Aug 21, 2026 · 7:18 AM UTC
• Version: 0.1.3

Overview

This skill mostly matches a Beatra video-retouch workflow, but it asks for broad account authority and can silently update its own installed code.

Review this before installing if you are not comfortable giving Beatra a shared, broad media-generation token or allowing the package to auto-update itself. Disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if you install it, and revoke the Beatra device authorization from the Beatra Console when you no longer use these skills.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require shell execution, filesystem access, network communication, environment use, and local state changes. This breaks least-privilege expectations and can cause the host to grant or exercise capabilities the user did not reasonably consent to, especially because the workflow also uploads files, stores credentials, and invokes external tools.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The advertised function is a focused video retouch, but the skill also performs authentication, persistent credential handling, remote tool invocation, uploads, telemetry-style registration, self-updating, and uninstall-side state deletion. That mismatch is dangerous because users may approve a narrow media-editing task without understanding that the package can modify the local installation, store long-lived access, and communicate broadly with external services.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: A skill presented as a one-pass video retouch includes package self-update logic that can change local code during ordinary command execution. Even with claimed integrity checks, auto-replacement of installed files materially expands the trust boundary and introduces supply-chain and persistence risk unrelated to the user’s immediate editing request.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatic download and installation are not necessary to fulfill the narrowly stated task of retouching a short video, so this capability is overbroad for the stated purpose. Unnecessary code acquisition increases attack surface and creates an avoidable path for supply-chain compromise or unexpected local changes.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documentation describes automatic outbound installation-registration telemetry that is unrelated to the skill's stated video-retouch purpose. Even though the data is framed as non-secret and non-billable, it still discloses package, version, platform, and installation reference information to an external service without a clear functional need for core video processing, creating unnecessary privacy and supply-chain tracking risk.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill documents host-environment detection and registration of installation metadata, which is not justified by a video-retouch workflow. Environment fingerprinting can be used to classify hosts, correlate installations, and expand telemetry beyond user expectations, increasing the sensitivity of the collected data and the potential for misuse or tracking.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The authorization flow requests a very broad OAuth scope set, including artifacts, images, videos, music, speech, voices, wallet spending, and task control, which is far beyond what a video realism retouch skill appears to need. Over-scoped tokens violate least privilege and materially increase blast radius if the credential is misused, compromised, or the skill behaves unexpectedly.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The scope includes unrelated capabilities such as image generation, music generation, speech generation, and voice read/write access that do not match a focused video realism retouch skill. This creates unnecessary privilege exposure and could enable abuse of user resources or data domains unrelated to the advertised feature set.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The scope includes unrelated capabilities such as image generation, music generation, speech generation, and voice read/write access that do not match a focused video realism retouch skill. This creates unnecessary privilege exposure and could enable abuse of user resources or data domains unrelated to the advertised feature set.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code collects host platform, device name, installation path, and a local inventory of installed skills, which exceeds the narrow functional need of authorizing a video retouch skill. While this appears operational rather than overtly malicious, it increases privacy exposure and creates additional local telemetry about the user's environment that could be sensitive if accessed or later transmitted.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements a broad self-update system that downloads manifests and archives, validates them, and replaces installed package files, behavior unrelated to a video retouch skill's stated purpose. Even with integrity checks, self-modifying code materially expands the trust boundary and creates a supply-chain attack surface where compromise of the update channel, publisher account, or signing process can silently change local code.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The client records installation telemetry and maintains a local skill inventory despite the declared functionality being video realism retouching. This creates unnecessary data collection and persistent tracking metadata, which increases privacy risk and can expose local environment information without being essential to the advertised task.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code fingerprints the host environment by inspecting agent-specific environment variables and persisted host metadata, then propagates that platform identity in requests. For a video retouch tool this is not functionally necessary, and it increases device/application profiling risk while enabling more tailored server-side behavior based on the host agent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Maintaining a device-local inventory of installed skills is unrelated to the stated video retouch purpose and creates a local surveillance/tracking capability. Such inventories can reveal user tooling, installed capabilities, and workstation history, which can aid profiling or follow-on targeting if accessed or later transmitted.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that silent automatic updates may occur during ordinary commands, but this is disclosed late and not surfaced as a primary workflow warning. That is dangerous because users may trigger code download and installation without informed consent, undermining transparency and violating expectations for a simple video-editing operation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation. Even though it describes integrity checks and constrained update sources, enabling unattended file replacement by default reduces user control and can introduce unexpected code changes into the local installation, which is a meaningful supply-chain and trust-boundary risk if the update channel or signing/check mechanisms are ever compromised or misunderstood.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation states that the client automatically performs registration and writes a local cache, but provides no explicit user warning, consent flow, or opt-in guidance. Silent outbound communication and local state creation undermine transparency and user control, especially when the behavior is outside the expected scope of a creative media skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The maybe_auto_update() path performs silent automatic updates that can replace installed files without user-facing notice or confirmation during normal command execution. Silent modification of local code is risky because users may execute materially different code than the version they installed, and an update-channel compromise would be applied with little visibility.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: Installation registration telemetry sends package, version, platform, and installation reference metadata to a remote service, while this behavior is not apparent from the skill's user-facing purpose in the file. Although the data volume is limited, undisclosed telemetry is a trust and privacy concern, especially when coupled with platform detection and local inventory tracking.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The exposed self-update command explicitly supports replacing package files in place, which is self-modifying behavior outside the stated video-retouch function. In skill context this is more dangerous because a media-processing tool is expected to transform user content, not to rewrite its own executable code, so the feature materially increases supply-chain and persistence risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.