wechat-channels-cover-maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:15 AM UTC
• Version: 0.1.3

Overview

The skill is a real cover-making integration, but it asks for broad Beatra account powers and can silently replace its local code by default.

Review this carefully before installing. It may be appropriate only if you trust Beatra with a broad shared device authorization, possible credit spending, and default automatic package updates. Disable auto-updates with the documented command if you need review-before-change behavior, and revoke the Beatra device from the console if you no longer trust the connection.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:31

Finding

Cover-Making Skill Requests an Overprivileged Shared Device Credential

Content

View full analysis

``` Consequently, possession of the shared credential is not constrained to the image tools described by the Skill. The documented paid-call confirmation workflow reduces accidental image-generation charges, but it is an Agent instruction rather than an authorization boundary and does not technically prevent another caller or compromised package from invoking unrelated tools. ### Attack Path 1. The user runs `scripts/authorize.py` while installing or reconnecting the Skill. 2. The authorization request asks for the complete `SCOPE` ...[truncated 1079 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:972

Finding

Ordinary Commands Silently Retrieve and Install Remotely Mutable Code

Content

View full analysis

tuple[str, str]: version = discovery.get("version") archive = discovery.get("archive") manifest = discovery.get("manifest") base_url = discovery.get("base_url") expected_base = PACKAGE_CDN_BASE_TEMPLATE.format(version=version) expected_archive = f"{PACKAGE_SLUG}-skill-{version}.zip" if ( discovery.get("schema_version") != 1 or discovery.get("package") != PACKAGE_SLUG or discovery.get("channel") != PACKAGE_CHANNEL or discovery.get("locale") != PACKAGE_LOCALE or not isinstance(version, str) or archive != expected_archive or manifest != "skill-manifest.json" or base_url != expected_base or not isinstance(discovery.get("archive_sha256"), str) or _SHA256.fullmatch(discovery["archive_sha256"]) is None or not isinstance(discovery.get("manifest_sha256"), str) or _SHA256.fullmatch(discovery["manifest_sha256"]) is None ): raise RuntimeError("Beatra update discovery is invalid") parsed = urllib.parse.urlsplit(expected_base) if ( parsed.scheme != "https" or parsed.hostname != "cdn.beatra.ai" or parsed.u ...[truncated 5342 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The authorization scope includes voice, speech, music, and video generation plus voice management permissions, none of which are necessary for a cover-image maker as described. These excess privileges create unnecessary access to sensitive or billable media capabilities and broaden the consequences of token theft or misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill references uninstall/disconnect behavior, local state inspection under ~/.beatra, installed-skill inventory handling, network revocation, and deletion of credential/config files, none of which are apparent from the cover-generation description. Hidden or under-disclosed maintenance capabilities are dangerous because they can modify or remove local configuration and affect other shared auth state on the host.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill references uninstall/disconnect behavior, local state inspection under ~/.beatra, installed-skill inventory handling, network revocation, and deletion of credential/config files, none of which are apparent from the cover-generation description. Hidden or under-disclosed maintenance capabilities are dangerous because they can modify or remove local configuration and affect other shared auth state on the host.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill references uninstall/disconnect behavior, local state inspection under ~/.beatra, installed-skill inventory handling, network revocation, and deletion of credential/config files, none of which are apparent from the cover-generation description. Hidden or under-disclosed maintenance capabilities are dangerous because they can modify or remove local configuration and affect other shared auth state on the host.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

bundled `scripts/mcp_client.py` for remote Beatra operations. Do not configure

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

bundled `scripts/mcp_client.py` for remote Beatra operations. Do not configure

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

bundled `scripts/mcp_client.py` for remote Beatra operations. Do not configure

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

bundled `scripts/mcp_client.py` for remote Beatra operations. Do not configure

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 61)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill is a WeChat cover-image maker, but the requested OAuth scope includes capabilities far beyond that function, including artifact read/write, task control, image/video/music/speech generation, voice access, and wallet spending. Overbroad authorization violates least privilege and materially increases blast radius if the skill, credential store, or downstream service is abused or compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The authorization scope includes voice, speech, music, and video generation plus voice management permissions, none of which are necessary for a cover-image maker as described. These excess privileges create unnecessary access to sensitive or billable media capabilities and broaden the consequences of token theft or misuse.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill includes a self-update mechanism capable of modifying its own installed files, and normal command flow also invokes silent update checks. In a creative skill whose expected job is image generation support, self-modification is especially risky because users would not reasonably expect code replacement behavior, making supply-chain compromise or policy bypass more consequential.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool/permission boundaries even though its documented workflow relies on shell execution, file access, environment access, and networked operations. In an agent setting, missing scope declarations increase the chance that the skill can exercise broader capabilities than users expect, especially when combined with upload, auth, update, and local state operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes automatic self-update and package replacement capability unrelated to generating cover images. Any mechanism that can replace local package files expands the trust boundary substantially; if the update channel, signing, or implementation is flawed, it becomes a code-delivery path with potential for persistent compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic updates are enabled silently and can modify local package-owned files without an upfront user warning at the point of use. Even if limited to package files, silent modification reduces user awareness and can create unexpected code changes in an environment that may handle credentials, uploads, and networked operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json

"icon": "https://beatra.ai/textures/icons/wechat-channels-cover-maker-0.1.1.png",
  "localized": {
    "en": {
      "description": "Create a WeChat Channels video cover, WeChat Video Account cover, or WeChat Channels thumbnail from a video topic, title, script, key frame, portrait, product photo, or reference image. This AI video cover maker builds a clear focal visual, a text-safe area, and a channel-consistent cover direction for WeChat Channels videos, creator updates, product explainers, local-business posts, and knowledge content.",
      "display_name": "WeChat Channels Cover Maker",
      "summary": "Turn a video topic, title, script, key frame, portrait, product photo, or reference image into a clear WeChat Channels cover with a focal visual and text-safe space.",
      "tags": [

Static analysis

No suspicious patterns detected.