voiceover-narration-studio

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:22 AM UTC
• Version: 0.1.7

Overview

This voiceover skill is mostly coherent, but it uses broad Beatra account permissions and silently updates its own local code during normal use.

Review this carefully before installing. It can store a Beatra device credential, spend account credits for approved generation, upload local voice samples when requested, send installation metadata to Beatra, and silently auto-update its installed files unless automatic updates are disabled. Install only if you trust Beatra with those broader account and update privileges.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes a bundled Python client with shell execution, file access, network access, and local state handling, yet no permissions are declared to users. That creates a transparency and consent gap: a user expecting a simple voiceover workflow may trigger credential storage, uploads, or local file changes without an explicit permission model.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior substantially exceeds the advertised voiceover purpose by including authentication, credential storage, generic remote tool invocation, file upload, telemetry/registration, uninstall logic, and package self-update. This mismatch is dangerous because users and reviewers cannot accurately assess the trust boundary; a seemingly narrow media skill effectively operates as a privileged installer/updater and remote client.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill documentation embeds self-updating package behavior that goes beyond the core voiceover function. Even if the updater claims verification controls, introducing software modification into routine use expands the attack surface and changes the risk profile from content generation to code lifecycle management.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Automatic download and replacement of local package files is not necessary for generating voiceovers and creates a direct software supply-chain risk. If the update channel, signing process, or client is ever compromised, ordinary skill use could silently install malicious code with the skill's local privileges.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The document states that one approval covers image, video, music, speech, upload, model, and task tools, which is materially broader than a voiceover-only skill. That indicates the skill may obtain or normalize access to unrelated capabilities, violating least privilege and increasing the chance of abuse or scope creep if the remote service exposes powerful tools.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The bundled MCP client instructions expose generic tool discovery and arbitrary remote tool invocation via `tools` and `call`, rather than a fixed voiceover-specific interface. In a voiceover skill, this creates an unnecessary execution surface that could be used to access unintended backend actions if additional tools are available remotely.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly documents a generic remote MCP invocation flow, including session handling and `tools/call` execution, without constraining callable methods to the voiceover use case. Because the skill context is narrowly media narration, this unjustified general-purpose remote action channel is especially dangerous: it can become a capability escalation path to any backend tool the token can reach.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The authorization helper collects host platform signals, hostname-derived device name, and local install path, then persists them in host.json and skills.json even though those data are not necessary for core voiceover generation. This expands the skill's local data footprint and creates device-identifying telemetry/inventory data that could be exposed by compromise of the state directory or reused for tracking across skills.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The client contains a full self-update mechanism that downloads manifests and archives, validates them, and then overwrites files in the local installation directory. Even though integrity checks are present, this is a powerful installation-mutation capability unrelated to a voiceover skill's stated purpose, and it materially increases the blast radius if the update channel, publisher account, or trust root is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code records installation telemetry and a persistent local inventory of installed skills in ~/.beatra, which is outside the expected scope of a voiceover-generation client. This creates additional privacy and tracking surface, especially when combined with periodic registration calls to a remote service, and users would not reasonably expect this from the declared functionality.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The client fingerprints the host environment by inspecting environment variables and local host metadata to classify platforms such as claude-code or codex. For a voiceover skill, this data collection is not functionally necessary and can be used for profiling, telemetry enrichment, or environment-aware behavior that users are not expecting.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Maintaining a device-local inventory of installed skills introduces persistent cross-skill tracking that is unrelated to generating voiceovers. In the context of this skill, it broadens local surveillance and can support later telemetry, uninstall logic, or correlation of user activity across packages without a clear need tied to the advertised capability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill discloses auto-update behavior inside the documentation, but not prominently enough for informed consent given that ordinary commands may change local software without separate approval. This is dangerous because users may believe they are only making a remote synthesis request when they are also permitting local code modification.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer versions by default without separate confirmation. Even though the text describes strong integrity controls, silent self-updating that replaces local files changes executable behavior without an explicit per-update user decision, which creates supply-chain and operational risk if the update channel, signing/checking logic, or upstream infrastructure is ever compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation states that the client automatically performs an installation registration call on first use and transmits package, version, platform, and a stable external installation reference, but it does not clearly warn users or require explicit consent before this telemetry-like data is sent. Even if described as non-secret and non-billable, automatic transmission of environment and installation metadata can create privacy and tracking concerns, especially because the stable installation reference may enable persistent correlation across uses.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The code writes platform and device_name metadata to host.json silently and explicitly treats failure as best-effort, with no user-facing disclosure. Silent persistence of host-identifying metadata is a privacy weakness because users are not informed that local environment details are being recorded as part of authorization.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The auto-update path silently performs network discovery, downloads code, and mutates installation files during normal command execution without a user-facing prompt at the moment it occurs. Silent self-modification is especially risky in an agent skill because it changes trusted local behavior outside the user's active awareness and can complicate review, forensics, and consent.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 88% confidence
• Finding: The code requests and stores a bearer token with a very broad scope set, including wallet spending and multiple content-generation permissions, in a shared local credentials.json file. If that file is stolen by malware, another local user, backup leakage, or misconfigured permissions on non-POSIX systems, an attacker could directly reuse the token for high-impact account actions beyond voice generation.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The exposed self-update command advertises and enables self-modification of the installed package, which is a high-risk capability for a skill whose manifest describes voiceover and narration features rather than software maintenance. In context, this unnecessary code-mutation capability increases supply-chain risk and gives the package authority to rewrite itself locally, making compromise more consequential.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.