Back to skill

Security audit

viral-video-teardown-remake

Security checks across malware telemetry and agentic risk

Overview

The skill’s video-remake workflow is mostly disclosed, but it uses broad Beatra account authority and silently updates its own code by default, so it should be reviewed before installation.

Install only if you are comfortable giving this package a shared Beatra credential with paid media-generation authority and allowing its bundled client to update package files automatically by default. Before use, consider running `python3 scripts/mcp_client.py update --auto off`, review the Beatra approval scopes, and avoid uploading local files unless you selected them intentionally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no permissions while its documented behavior includes shell execution, filesystem access, environment access, and networked tool invocation. That mismatch can bypass least-privilege review and cause operators to approve a package without understanding that it can read local data, persist files, and contact remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill is presented as a video-analysis/remake workflow, but the documented behavior extends into credential handling, generic remote tool execution, arbitrary file upload, self-update, telemetry/registration, and uninstall/revocation logic. This broad hidden capability increases the attack surface significantly and can be abused to access local content, exfiltrate data, modify the installation, or perform actions beyond the user’s reasonable expectations.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The authorization helper fingerprints the host environment and collects a recognizable device name/hostname, then persists that metadata locally and sends platform/device information during authorization. For a skill whose stated purpose is short-video teardown/remake, this data collection exceeds obvious functional need and creates unnecessary privacy exposure and environment attribution risk if the state directory or upstream service is compromised.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The requested OAuth scope includes wallet spending, voice read/write, music generation, and task/artifact capabilities that are broader than the described video-remake workflow. Overbroad scopes violate least privilege and increase blast radius: compromise or misuse of the token could enable spending, voice asset access/modification, or other actions unrelated to the skill's advertised function.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file contains a full self-update mechanism that downloads manifests and archives and replaces local installation files, which is materially outside the advertised video-analysis/remake behavior. Even with checksum and path checks, bundling silent code replacement into a content-creation skill expands trust boundaries and creates a supply-chain-style execution path whereby compromise of the vendor update channel or packaging process can modify local code.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill records local inventory and installation telemetry unrelated to its declared creative function, including install paths, platform, timestamps, and external installation references. This unnecessary collection increases privacy and tracking risk and is more suspicious because it is hidden in a skill whose described purpose is viral-video teardown and remake rather than device inventory or telemetry.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code fingerprints the host agent environment by inspecting environment variables and host metadata to derive platform identity. For a video-remake skill, this capability is not functionally necessary and can support tracking, segmentation, or environment-aware behavior that users would not reasonably expect from the stated purpose.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The manifest explicitly advertises collection of third-party video metadata, comments, and transcripts, but does not provide a visible privacy or data-use notice to the user. In this context, the skill handles potentially personal or platform-restricted content from external sources, so omission of disclosure increases privacy, consent, and compliance risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document explicitly states that the client silently checks for updates and installs higher versions automatically without separate confirmation. Even with integrity checks and pinned sources, replacing installed executable files by default without a prominent warning or opt-in creates a supply-chain and user-consent risk: if the trusted update channel is ever compromised or an update is unexpected, code on the user's system can change without an interactive decision.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The script writes host metadata such as detected platform and device name to host.json without notifying the user. While not an immediate code-execution issue, undisclosed persistence of environment-identifying data is a privacy concern and can aid local profiling or forensic correlation if the machine or account is later accessed by an attacker.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The script records a local inventory of installed skill paths and platform metadata in skills.json without user disclosure. Installation paths can reveal usernames, directory structures, and usage history, which is unnecessary sensitive metadata for a content-remake skill and may become useful to attackers or intrusive telemetry consumers.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill performs best-effort silent automatic updates that can modify local installation files during normal command execution without an execution-time prompt. In the context of a creative-analysis skill, silent self-modification is unexpected and increases the risk of unnoticed code changes, especially if the update infrastructure is compromised or if users rely on stable reviewed code.

Credential Access

High
Category
Privilege Escalation
Content
def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):
Confidence
72% confidence
Finding
The uninstall script reads an access token from ~/.beatra/credentials.json and uses it to call a remote revocation endpoint. Although this appears operationally legitimate, it is still direct credential access by a skill script; if the script, path resolution, or surrounding install model were compromised, this creates a credential-handling surface that could be abused to misuse or exfiltrate the token.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
96% confidence
Finding
The exposed self-update command explicitly supports self-modification of the local package, which is risky in a skill that is supposed to analyze and remake short videos. Any self-modifying capability broadens the blast radius from data processing to code replacement, and in combination with remote download logic it creates a supply-chain attack surface that is disproportionate to the declared function.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.