wechat-channels-product-video

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:30 AM UTC
• Version: 0.1.7

Overview

This skill is a coherent Beatra video tool, but it uses broad account authority and silent self-updates that users should review before installing.

Install only if you are comfortable with a Beatra package that keeps a shared local Device Token, can spend credits after user-approved paid actions, registers installation metadata, and silently updates its package files by default. Review the Beatra account scopes and consider running `python3 scripts/mcp_client.py update --auto off` after installation if you do not want automatic code replacement.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill invokes shell commands, reads and writes local files, uses network access, and manages local credentials, yet it declares no permissions. That creates a transparency and consent gap: users and hosting platforms cannot accurately assess or constrain what the skill can do before execution. In this context, the gap is more dangerous because the skill handles uploads, authentication, billing-related actions, and local package changes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is video creation, but the skill also performs authentication, persistent credential storage, arbitrary file upload, telemetry/installation registration, uninstall-side server interactions, and self-update/package replacement. This mismatch undermines informed consent and can cause users to approve a media workflow while unknowingly granting a much broader trust boundary over their machine, files, and account. The context increases risk because these hidden behaviors involve remote communication, local persistence, and code lifecycle management unrelated to the core creative task.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill includes self-update and package replacement behavior that is not necessary for generating a product video. Any mechanism that downloads and installs code changes expands the attack surface significantly: compromise of update infrastructure, signing/verification logic, or package ownership checks could lead to arbitrary code execution on the host. This is especially risky in a skill package because users may not expect creative tooling to modify its own installation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation describes automatic installation registration behavior that is unrelated to the advertised purpose of creating WeChat product videos. Even if framed as non-billable and non-secret, this introduces undisclosed telemetry and environment-linked tracking capability into a creative skill, expanding data collection beyond user expectations and increasing supply-chain trust risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The file documents sending package slug, version, platform, and a stable external installation reference to an external service, plus resolving the real agent environment from signatures or a host file. For a product-video generation skill, this environment fingerprinting and external registration are unjustified by function and create a privacy and tracking surface that could be used to correlate installations across time or environments.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The requested OAuth scope is far broader than the skill’s declared purpose of creating a product-display video from provided inputs. It includes unrelated capabilities such as wallet spending, task cancellation, speech/music generation, and artifact read access, so a granted token could be used for actions well beyond the user’s expected consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The scope explicitly requests wallet:spend and voices:read/voices:write even though those capabilities are not justified by a WeChat product-video creator. If the token is compromised or the service misuses it, it could enable monetary spending and manipulation of voice assets, which materially raises the risk beyond ordinary media generation.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The client implements broad package lifecycle behavior including discovery, download, verification, installation, rollback, and update locking, which is unrelated to the stated purpose of making and publishing product showcase videos. Expanding a creative skill into an installer/self-manager increases attack surface and trust requirements; if the update channel or package publisher is compromised, the skill can replace its own local code.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code fingerprints the host environment, records local skill inventory, reads installation identifiers, and sends installation registration telemetry to a remote service. For a skill advertised as creating WeChat product videos, this data collection is unnecessary to the core function and creates privacy and governance risk, especially because it runs best-effort on ordinary use paths.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The uninstall script handles shared device credentials and can revoke a remote authorization token, which is unrelated to the advertised product-video creation purpose of the skill. Even though the code is written defensively, it still grants the package authority over a shared authentication context, so a user installing a media skill may unknowingly permit account-affecting actions outside expected scope.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This code performs an authenticated POST to revoke device authorization, giving the skill the ability to affect server-side account state. In the context of a video-generation skill, that capability is over-privileged and creates a trust-boundary violation: compromise or repurposing of the package would let it disrupt access rather than merely remove local files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that newer releases are installed automatically without separate confirmation, but it does not give a prominent user-facing warning that executable local code may change silently. Silent code replacement reduces user awareness and review opportunities, making supply-chain or publisher-account compromise more damaging. In this context, the risk is amplified because the same package already has shell, file, and network capabilities.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document describes a client that silently checks for and automatically installs newer releases by default before normal commands, without explicit per-update confirmation. Even with integrity checks and rollback protections, this behavior changes installed software automatically and can violate user expectations, create supply-chain exposure if the trusted update source is ever compromised, and materially alter the local system during unrelated work.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that on first use the client automatically performs an external registration call and writes a local registrations cache, but does not provide an explicit user-facing warning or consent flow. Silent telemetry and local state creation are risky because users invoking a media-creation skill would not reasonably expect outbound registration or persistent tracking artifacts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: maybe_auto_update() silently checks for and applies package updates during normal command execution, modifying local installation files without a user-facing prompt at execution time. Even with checksum and manifest validation, this creates a remote code modification path that users may not expect from a video-making skill; compromise of the vendor distribution path or signing process would directly impact the local environment.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 87% confidence
• Finding: The script is designed to delete shared state files including credentials.json, demonstrating that this package is aware of and operates on credential-bearing storage outside its functional domain. Access to shared credential material is sensitive because any code path that can enumerate, read, or remove those files can be modified or abused to exfiltrate secrets or break other installed skills.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 97% confidence
• Finding: The _device_token function reads an access token directly from credentials.json so it can be used in an Authorization header for a remote API call. Direct token access by a skill is dangerous because the token could be reused for unintended API actions if the package is tampered with, and this is especially unjustified for a product-video generation skill.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 95% confidence
• Finding: The exposed CLI includes a self-update capability, and the broader file contains code that downloads and replaces package files in the local installation. Self-modifying behavior is especially risky in a skill whose declared purpose is simple media creation, because it grants the package an ongoing path to alter executable code after installation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.