voice-cloning-studio

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:20 AM UTC
• Version: 0.1.9

Overview

The skill performs the advertised voice-cloning workflow, but it also stores broad account credentials, sends installation telemetry, and silently self-updates package code by default.

Install only if you are comfortable with Beatra account authorization, upload of authorized voice samples, local storage of a broad bearer token under ~/.beatra, installation registration telemetry, and silent package self-updates. Consider disabling automatic updates with the documented update --auto off command before using it in a sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes shell commands, reads local files, uploads local content, uses networked remote tool calls, and performs local writes, yet declares no permissions. This creates hidden capability expansion: users and host systems cannot accurately assess what the skill may access or modify, including local audio samples, credentials, and package files. In this context, undeclared file/network/shell access is especially risky because the skill handles sensitive biometric voice data and account-linked operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is voice cloning, but the skill also includes OAuth credential handling, arbitrary remote MCP tool invocation, uploads, telemetry/registration, self-update, and uninstall/state-cleanup behavior. That mismatch prevents informed consent and widens the attack surface beyond what a user would reasonably expect from the description, especially because some of these functions can alter the local environment or transmit additional data.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Automatic self-update is unrelated to the core voice-cloning function and introduces a software supply-chain risk path. Even with stated verification, a self-updater that downloads and replaces package-owned files can be abused if the update channel, signing, verification logic, or distribution process is compromised, and it expands the skill's authority from task execution to code modification.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly describes automatic installation registration that sends package slug, version, platform, and a stable external installation reference to a backend, which is telemetry outside the core voice-cloning function. Even if labeled non-billable and non-secret, undisclosed device/installation tracking creates privacy and transparency risk, especially because it occurs on first use and is designed to persist across time via a stable identifier and local cache.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This file describes backend installation tracking capabilities that are not justified by the skill's stated user-facing purpose of voice cloning. The mismatch between expected functionality and hidden registration behavior increases the risk of covert analytics or environment fingerprinting, particularly through collection of platform and stable installation reference data.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The authorization flow collects host platform and device hostname and persists them to host.json, even though voice cloning itself does not require long-term storage of host-identifying metadata. This expands the local privacy footprint and can expose environment and device identity information to other local processes or future components that read the shared state directory.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill writes a persistent inventory of installed skills, including install_path, platform, slug, and timestamps, into a shared local file unrelated to the stated voice-cloning function. This creates unnecessary surveillance-like state about the user's environment and software inventory, which could be sensitive if accessed by other local software or reused for tracking.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The client contains a full self-update mechanism that downloads manifests and archives from remote infrastructure and replaces local package files, behavior not necessary for voice cloning itself. Even with checksum and path validation, this materially expands the trust boundary and creates a supply-chain/self-modification capability inside a creative skill, increasing the damage if the update channel or publisher account is ever compromised.

Description-Behavior Mismatch

Low

• Confidence: 90% confidence
• Finding: The skill records local inventory in ~/.beatra/skills.json and sends installation registration telemetry including package, platform, and external installation reference, which is unrelated to the stated voice-cloning function. This creates unnecessary collection and persistence of device-local metadata and remote telemetry, which can expose user environment details and usage patterns.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The code fingerprints the host environment using environment variables and a local host.json file to classify the platform (for example, claude-code or codex). This is not needed for core voice-cloning behavior and increases privacy risk and tracking capability, especially when combined with registration telemetry.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that updates install automatically without separate confirmation, while the description does not warn users before use. Silent code replacement undermines user control and trust, and in combination with local file-write and network capabilities can turn the skill into a persistent code-delivery mechanism if the update process is compromised or misconfigured.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The manifest markets voice cloning and reuse but provides no warning that users must have explicit authorization to clone a person's voice or that uploaded samples may contain sensitive biometric data. In a voice-cloning context, omission of consent and privacy guidance materially increases the risk of impersonation, non-consensual voice replication, and unsafe handling of highly sensitive audio data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The localized Japanese and Chinese descriptions promote cloning and reusing a voice without corresponding warnings about consent, authorization, impersonation risk, or privacy. Because these are user-facing strings, missing safeguards across locales can cause non-English users to receive no safety notice at all for a capability that is inherently abuse-prone.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that the client silently checks for updates and installs newer releases automatically without separate confirmation before ordinary commands. Even with integrity checks and fixed sources, silently replacing installed package files by default is a security-relevant system modification that reduces user awareness and consent, and could amplify harm if the update channel or signing/checksum process is ever compromised.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that the client automatically performs registration and writes to ~/.beatra/registrations.json, but it does not present an explicit user warning about outbound telemetry or filesystem modification. Silent network calls and local persistence can violate user expectations, enterprise policy, or privacy requirements, and the stable cache behavior makes the tracking durable across sessions.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code persists host and installation metadata without any explicit warning or confirmation at the point of collection. While the data is written locally rather than exfiltrated, the lack of transparency prevents informed consent and increases privacy risk for a feature outside the core voice-cloning workflow.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The helper stores a bearer access token and related identifiers on disk in credentials.json without an explicit warning before persistence. Even with restrictive POSIX permissions, a bearer token is highly sensitive because any local compromise, backup leakage, or accidental file exposure could allow unauthorized use of the Beatra account capabilities granted by the broad scope.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: maybe_auto_update() silently checks for, downloads, and applies code updates during normal command execution, without a user-facing warning at the time of modification. In the context of a voice-cloning skill, hidden self-modification is especially risky because it changes executable code outside the user's immediate intent and can turn any later compromise of the update channel into remote code replacement on user systems.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The registration path sends package/version/platform/installation reference data as best-effort telemetry without user-facing disclosure in this execution path. While not code-execution dangerous by itself, undisclosed outbound telemetry is a real security and privacy concern because it leaks environment and usage information unrelated to the declared creative task.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 80% confidence
• Finding: This code persists a live bearer access token to disk under a shared state directory, enabling reuse of the credential outside the immediate interactive authorization session. Because the granted scope includes sensitive capabilities such as wallet spending and content generation, compromise of the local file could directly translate into account abuse.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The exposed CLI includes a self-update command and the broader file implements code replacement of the installed package. Self-modification is dangerous because it enables remote changes to executable behavior after installation; in a voice-cloning skill this is unrelated to core functionality and significantly raises supply-chain and persistence risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.