Back to skill

Security audit

wechat-channels-cover-maker

Security checks across malware telemetry and agentic risk

Overview

The cover-making function is coherent, but the skill also uses broad shared authorization, registration telemetry, and default silent self-updates that warrant careful review before installing.

Install only if you are comfortable granting Beatra a broad shared device authorization and allowing this package to update its own files by default. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, avoid uploading sensitive portraits or confidential product images unless Beatra handling is acceptable, and revoke the Beatra device connection when it is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares itself as a cover-image maker, but its documented operation requires broad capabilities including file access, shell execution, network access, and environment usage through a bundled client. That gap reduces transparency and prevents users or policy systems from making an informed trust decision about the true privilege level of the skill.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior substantially exceeds the stated purpose: beyond creating cover images, it performs authentication, persistent credential storage, remote API access, file upload, telemetry/registration, uninstall cleanup, and software update/install actions. This is dangerous because users may invoke a seemingly narrow creative skill while unknowingly authorizing a much broader trust boundary involving local state, credentials, and code-changing operations.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill includes a silent self-update mechanism that can download and replace package-owned files automatically, which is unrelated to the user-facing task of making WeChat cover images. Even with claimed verification, silent code replacement materially increases supply-chain and post-installation risk because future behavior can change without a fresh user review or approval at time of use.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest presents the skill as a content-creation tool, but the documentation adds software download and local file replacement behavior that materially changes the security profile. This mismatch is risky because operators may approve the skill for low-risk media generation while overlooking that it can modify its own installed code over time.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The documentation describes a bundled client that silently checks for and automatically installs updates before normal commands, which is unrelated to the stated purpose of generating WeChat video covers. Even though the text claims integrity checks and rollback protections, introducing self-updating behavior into an otherwise content-generation skill expands the attack surface and creates a software supply-chain risk if the update channel or implementation is compromised.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The document describes automatic external installation-registration telemetry that sends package slug, version, platform, and a stable external installation reference on first use, which is unrelated to the stated purpose of generating WeChat video covers. Even if labeled non-billable and best-effort, this is still outbound data collection and persistent tracking behavior that expands the skill's capabilities beyond user expectations and creates privacy and supply-chain risk if deployed without clear consent.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The documented behavior collects environment/platform signatures, reads from host metadata, and persists registration state in a local cache, none of which is necessary to create image covers from user content. In the context of a media-generation skill, this additional host fingerprinting and metadata persistence increases the chance of unintended device correlation, privacy leakage, or covert telemetry, making the mismatch between capability and purpose more concerning.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The OAuth scope string requests far more access than is needed for a WeChat cover-making skill, including wallet spending, task control, voices, music, and broad generation capabilities. If this credential is approved or later reused by the skill or related components, compromise or misuse would grant excessive privileges well beyond the advertised functionality, violating least privilege and increasing blast radius.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The code detects the host agent platform from environment variables and captures a recognizable device hostname, then persists that metadata locally and sends platform/device data during authorization. For a cover-maker skill, this collection is not clearly necessary and creates avoidable fingerprinting of the user's environment, which can aid tracking, correlation, or targeting if exposed server-side or through logs.

Context-Inappropriate Capability

Medium
Confidence
80% confidence
Finding
The authorization helper maintains a persistent local inventory of installed skills and their install paths under the shared state directory. That creates additional tracking data unrelated to the stated cover-making purpose and exposes local filesystem layout and tool usage information if the state directory is later read by another process or compromised.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
The skill client contains broad self-update, installation management, recovery, locking, inventory, and telemetry capabilities that are unrelated to the advertised cover-generation function. In the context of a creative media skill, bundling package mutation and device-management behaviors increases attack surface substantially and enables remote code/content replacement if the update channel or publisher is ever compromised.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code fingerprints the host execution environment using environment variables and local state, then injects source_package_slug and source_platform into every business tools/call request. For a cover-making skill, this is unnecessary for core function and creates extra metadata leakage that can be used for user/tool profiling and cross-environment tracking.

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
The client records a local inventory of installed skills and performs remote installation registration unrelated to generating video covers. This creates a device-level software inventory and transmits installation metadata off-host, which expands privacy risk and can support tracking or ecosystem mapping beyond the user’s expected task.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
Automatic updates that replace package files are introduced later in the document without prominent upfront warning in the overview or scope section. This weak disclosure is dangerous because users may consent to a creative workflow without understanding that activating the skill can also enable ongoing background code changes.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The manifest explicitly advertises processing portraits, product photos, and reference images via a remote MCP service, but provides no user-facing notice about sensitive media handling, transmission, or retention. Because portraits and business images can contain biometric, personal, or confidential information, the lack of disclosure increases privacy and consent risk for users uploading content.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The file states that update checks are silent, enabled by default, and that higher versions are installed automatically without separate confirmation. Automatic modification of local files without prominent user warning or explicit consent is dangerous because users may unknowingly execute changed code on later runs, which is especially concerning in a skill whose declared function does not require background software maintenance.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The markdown explicitly states that a registration call is made on first use, but it does not present this as a user-facing warning or consent step despite describing outbound data transmission. Silent telemetry in a creative cover-making skill is especially problematic because users would not reasonably expect installation metadata to be transmitted to an external service when performing local-looking design tasks.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
maybe_auto_update() performs silent, best-effort package updates during normal command execution, modifying local installation files without prominent user-facing disclosure at the time of action. Even with integrity checks, silent code replacement in a media-generation skill is risky because users may execute changed code they did not knowingly approve.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The registration path sends installation telemetry in the background and explicitly suppresses errors so it never blocks the main operation, which also means the behavior is easy for users to miss. In this skill context, undisclosed outbound telemetry is not necessary to create covers and creates avoidable privacy concerns.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
95% confidence
Finding
The client exposes explicit self-update functionality that can replace package files on disk, which is self-modification behavior unrelated to the stated cover-creation purpose. In practice, any compromise of the update infrastructure, signing/checksum workflow, or publisher account could turn this feature into a remote code deployment path on user systems.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.