youtube-thumbnail-maker

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:45 AM UTC
• Version: 0.2.2

Overview

The skill’s thumbnail workflow is mostly coherent, but it asks users to trust a broad persistent Beatra credential and a default silent self-update mechanism that can replace installed code without per-update approval.

Install only if you are comfortable connecting a Beatra account, storing a broad local Beatra Device Token, uploading selected source images to Beatra, and allowing the package to check for and install its own updates by default. Consider running `python3 scripts/mcp_client.py update --auto off` after installation if you want updates to be manual.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes local scripts and describes capabilities that require shell execution, file access, environment access, and network communication, but it does not declare those permissions up front. That weakens user visibility and host enforcement, making it easier for a thumbnail-design skill to perform broader local or remote actions than a user would reasonably expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a thumbnail generator, but its documented behavior includes OAuth authorization, local credential storage, arbitrary file upload, a generic MCP client for remote tool access, telemetry/installation registration, uninstall cleanup, and self-updating code. This is a substantial expansion of trust scope; if abused or compromised, it could access sensitive local files, persist credentials, and change behavior over time beyond what the user consented to for a simple design task.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that it can automatically install newer releases without separate confirmation. Even with integrity checks, silent self-update changes executable behavior after initial review and can introduce new capabilities or vulnerabilities without fresh user approval, which is especially risky for a package with shell, file-write, and network access.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer releases without separate confirmation. Even though it describes integrity checks and rollback protections, automatic code replacement on a user's local installation materially changes trusted software behavior and can create supply-chain risk, especially if the update infrastructure or signing/checksum chain is ever compromised.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code persists host metadata such as the detected platform and device hostname into host.json without any user-facing notice or consent flow. While this is not remote code execution or credential theft by itself, it creates a privacy issue because recognizable device information is written to disk and may later be consumed by other local components or exposed through support artifacts, backups, or multi-user environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill records a local inventory containing the package slug, platform, and resolved installation path into skills.json without informing the user. The installation path can reveal usernames, directory structure, or organizational details, making this a privacy-sensitive data collection issue that is broader than normal OAuth state and unnecessary to hide from the user.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The client performs silent automatic self-updates that can replace installed package files during normal command execution, without explicit user confirmation at update time or prominent disclosure in the operational path. Although the update flow includes integrity checks and path-hardening, any compromise of the trusted update channel, release process, or vendor-controlled manifest would let remote code changes land automatically on the user's machine.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 90% confidence
• Finding: The package includes first-class self-modification capability via its update command and also invokes best-effort auto-update in normal execution paths. In a skill context, self-modifying code materially raises supply-chain risk because the behavior of the installed agent can change after review, and a compromised vendor/update infrastructure could push new code into the environment.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.