ClawHub
Back to skill

Security audit

zhongcao-beauty-note-maker

Security checks for vulnerabilities and agentic risk

Overview

The skill can draft beauty posts, but it also grants broad shared Beatra account authority and can silently update its own code, so it needs careful review before installation.

Install only if you are comfortable giving this Beatra skill a shared broad device token, paid-call capability, local upload capability, and automatic code updates. Before use, consider disabling auto-updates with the documented command and monitor/revoke the Beatra device authorization from the Beatra Console if you no longer need it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/authorize.py:34
Finding

Full-Scope Shared Device Token Exceeds the Skill's Functional Requirements

Content
View full analysis

Vulnerability Details

File Location: scripts/authorize.py:34-37
Vulnerability Type: Excessive authorization scope and violation of least privilege
Risk Level: High

Vulnerable Code

python
SCOPE = (
    "mcp:tools artifacts:write images:generate videos:generate music:generate "
    "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel"
)

The resulting credential is deliberately shared between Beatra Skills, as documented in references/mcp-connection.md:8-10:

text
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`.

Technical Analysis

The Skill's declared paid capability is limited to six public Xiaohongshu lookup operations and related task polling. It does not need permission to generate images, videos, music, or speech; write voices; write arbitrary artifacts; spend wallet funds generally; inspect unrelated tasks or artifacts; or cancel tasks.

Nevertheless, authorization requests all of these capabilities in one shared bearer token. The code also rejects a credential unless it contains the complete broad scope set, preventing operation with a narrower token.

This violates least-privilege principles. Because the credential is shared between packages, compromise of this Skill, a future update, or another component able to execute the bundled client can expose authority extending well beyond Xiaohongshu lookup.

Attack Path

  1. The user runs scripts/authorize.py.
  2. The helper requests the complete scope set shown above.
  3. The user approves a single full-scope Device Token.
  4. The token is stored in ~/.beatra/credentials.json and reused by the bundled client.
  5. Malicious or compromised Skill code invokes unrelated Beatra tools using the bearer token.
  6. Those calls may spend credits, create media or artifacts, inspect account resources, or cancel unrelated tasks.

Impact Assessment

...[truncated 482 chars]

Remediation
View remediation

Remediation Suggestions

  • Issue a package-specific token instead of a shared full-scope device token.
  • Limit authorization to the exact public-social lookup operations and task polling required by this Skill.
  • Remove image, video, music, speech, voice-write, generic artifact-write, generic wallet-spend, and task-cancellation scopes.
  • Permit the client to accept narrower credentials rather than requiring equality with the complete scope set.
  • Apply server-side authorization policies based on the package identity; client-side instructions alone are insufficient.
  • Display the exact requested privileges to the user before opening the authorization page.
  • Separate paid-operation authority from non-billable lookup-discovery and verification authority.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/mcp_client.py:1438
Finding

Bundled Client Permits Arbitrary Remote Tool Invocation Without Enforcing the Skill Whitelist

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:1438-1479
Vulnerability Type: Unrestricted privileged tool invocation
Risk Level: High

Vulnerable Code

python
def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]:
    session = _session_with_registration(
        state_dir=Path.home() / ".beatra",
        post_json=_default_post_json,
    )
    if command == "tools":
        return session.request(2, "tools/list", {})
    try:
        arguments = json.load(os.sys.stdin)
    except json.JSONDecodeError as exc:
        raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc
    if not isinstance(arguments, dict):
        raise RuntimeError("Tool arguments on stdin must be one JSON object")
    assert tool_name is not None
    return session.request(
        2,
        "tools/call",
        {"name": tool_name, "arguments": arguments},
    )


def main() -> int:
    parser = argparse.ArgumentParser(description="Call Beatra through Streamable HTTP")
    subparsers = parser.add_subparsers(dest="command", required=True)
    subparsers.add_parser("verify", help="Run the non-billable connection check")
    subparsers.add_parser("tools", help="List available Beatra tools")
    call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin")
    call.add_argument("tool_name")

Technical Analysis

references/note-lookup.md:14-25 defines a whitelist of six permitted Xiaohongshu operations. The executable client does not enforce that whitelist. Instead, it accepts any caller-supplied tool name and forwards an arbitrary JSON object to tools/call.

Paid-call confirmation is also only expressed as natural-language guidance in the Skill documentation. The client does not require a confirmation record, approved operation key, approved price, schema hash, or user-bound request identifier before fo ...[truncated 1367 chars]

Remediation
View remediation

Remediation Suggestions

  • Hard-code an allowlist of the Beatra tools required by this package.
  • Enforce the six permitted Xiaohongshu operation keys in executable code.
  • Reject unknown tool names even if the server advertises them.
  • Separate diagnostic, discovery, task-polling, and paid-execution commands.
  • Require a structured local approval record containing the operation, live price, arguments digest, and user confirmation before a paid call.
  • Bind approval to one exact request and invalidate it after use.
  • Ensure pagination and changed arguments require a new approval.
  • Add server-side package restrictions so bypassing the local client cannot grant broader access.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/mcp_client.py:191
Finding

Generic Upload Command Can Read Arbitrary User-Accessible Files and Send Them to a Remotely Selected HTTPS Host

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:191-263, 1400-1436, 1480-1492
Vulnerability Type: Overprivileged local-file access and insufficient upload-host restriction
Risk Level: High

Vulnerable Code

python
def _read_local_upload(path: Path) -> tuple[str, bytes]:
    candidate = path.expanduser()
    descriptor = -1
    try:
        flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
        descriptor = os.open(candidate, flags)
        before = os.fstat(descriptor)
        if (
            not stat.S_ISREG(before.st_mode)
            or before.st_size < 1
            or before.st_size > MAX_UPLOAD_BYTES
        ):
            raise RuntimeError(
                f"Local upload must be one regular file between 1 and {MAX_UPLOAD_BYTES} bytes"
            )
        with os.fdopen(descriptor, "rb") as handle:
            descriptor = -1
            content = handle.read(MAX_UPLOAD_BYTES + 1)
            after = os.fstat(handle.fileno())
    ...
    return candidate.name, content
python
url = instruction.get("url")
headers = instruction.get("headers")
if not isinstance(url, str) or not isinstance(headers, dict):
    raise RuntimeError("Beatra upload instructions are invalid")
parsed = urllib.parse.urlsplit(url)
if (
    parsed.scheme != "https"
    or not parsed.hostname
    or parsed.username is not None
    or parsed.password is not None
    or parsed.fragment
):
    raise RuntimeError("Beatra upload instructions are invalid")
...
response = put_bytes(url, dict(headers), content)
python
local_upload = subparsers.add_parser(
    "upload",
    help="Upload one local regular file and print its artifact reference",
)
local_upload.add_argument("path", type=Path)

Technical Analysis

The beauty-note and Xiaohongshu lookup workflow does not require generic access to arbitrary local files. Neverthe ...[truncated 1594 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the generic upload command if it is not required by this Skill.
  • Restrict input paths to an explicit user-selected workspace or approved media directory.
  • Require direct confirmation displaying the canonical path, filename, size, MIME type, and destination before reading or uploading.
  • Deny sensitive locations such as home-directory credential stores, SSH directories, cloud configuration directories, browser profiles, and system configuration paths.
  • Allowlist exact upload hostnames or hostname suffixes controlled by Beatra.
  • Pin the expected upload endpoint identity where practical.
  • Do not accept arbitrary headers from a remote response without an explicit header allowlist.
  • Use a package-specific token whose permissions do not include generic artifact upload.

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/mcp_client.py:938
Finding

Silent Automatic Updates Permit Post-Review Remote Code Replacement

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:938-1018, 1514-1516
Vulnerability Type: Remote payload retrieval and execution through automatic package replacement
Risk Level: High

Vulnerable Code

python
def maybe_auto_update(
    *,
    state_dir: Path | None = None,
    install_root: Path | None = None,
    get_bytes: GetBytes = _default_get_bytes,
    now: float | None = None,
) -> bool:
    """Best-effort silent update. Never block the requested MCP command."""

    resolved_state = state_dir or Path.home() / ".beatra"
    try:
        resolved_root = (install_root or _current_install_root()).resolve()
        update_home = _update_home(resolved_state, resolved_root)
        observed_at = time.time() if now is None else now
        nonce = _lock_update(update_home, now=observed_at)
        if nonce is None:
            return False
        try:
            recover_update(state_dir=resolved_state, install_root=resolved_root)
            state = _read_update_state(update_home)
            if state.get("auto_update", True) is False:
                return False
            last_checked = state.get("last_checked_at")
            if (
                isinstance(last_checked, (int, float))
                and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS
            ):
                return False
            state["last_checked_at"] = observed_at
            _write_private_json(update_home / "state.json", state)
            checked = check_update(get_bytes=get_bytes)
            if not checked["update_available"]:
                return False
            _ensure_owned_baseline(
                install_root=resolved_root,
                update_home=update_home,
                get_bytes=get_bytes,
            )
            discovery = checked["discovery"]
            manifest, new_files = download_update(discovery, ge
...[truncated 2582 chars]
Remediation
View remediation

Remediation Suggestions

  • Disable automatic installation by default.
  • Require explicit user approval before replacing executable package files.
  • Show the current version, proposed version, source, and signing identity before installation.
  • Sign release manifests with an offline or separately controlled signing key.
  • Pin the corresponding public key in the reviewed package and verify signatures locally.
  • Keep checksum validation, archive limits, path checks, ownership checks, and rollback as defense-in-depth.
  • Consider downloading updates for review without installing them automatically.
  • Require renewed security review when an update modifies files under scripts/.

other

Note
Location
scripts/authorize.py:340
Finding

Authorization Collects and Transmits Hostname and Agent-Environment Telemetry

Content
View full analysis

Vulnerability Details

File Location: scripts/authorize.py:340-369, 455-466
Vulnerability Type: Unnecessary environment reconnaissance and host telemetry
Risk Level: Low

Vulnerable Code

python
def detect_host_platform(explicit: str | None = None) -> str:
    """The agent environment this process runs inside (docs/device-model.md).

    Order: explicit agent self-report > environment signatures > unknown.
    Detection reads the process environment only — nothing else runs,
    nothing reaches the network.
    """
    if explicit:
        candidate = explicit.strip().lower().replace(" ", "-")
        if _PLATFORM_VALUE.fullmatch(candidate):
            return candidate
    env = os.environ
    if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env:
        return "claude-code"
    if any(key.startswith("CODEX_") for key in env):
        return "codex"
    ai_agent = env.get("AI_AGENT", "").lower()
    matched = re.match(r"([a-z0-9-]+)_", ai_agent)
    if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)):
        return matched.group(1)
    return "unknown"


def device_display_name() -> str | None:
    """A hostname the user will recognise in the console device list."""
    try:
        name = socket.gethostname().strip()
    except OSError:
        return None
    if not name or not name.isprintable():
        return None
    return name[:120]

The collected values are included in the authorization request:

python
form: dict[str, str] = {
    "client_id": CLIENT_ID,
    "resource": MCP_URL,
    "scope": SCOPE,
    "platform": host_platform,
    "client_name": PACKAGE_DISPLAY_NAME,
    "external_installation_ref": external_reference,
    "package_version": PACKAGE_VERSION,
    "package_slug": PACKAGE_SLUG,
}
if device_name:
    form["device_name"] = device_name

Technical Analysis

The helper insp ...[truncated 1638 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not collect or transmit the system hostname by default.
  • Use a random, non-identifying device label or stable opaque identifier.
  • Allow the user to choose an optional display name explicitly.
  • Make platform telemetry opt-in unless it is essential to protocol operation.
  • Present all transmitted metadata fields before authorization.
  • Minimize persisted host metadata and provide a direct command to inspect and delete it.
  • Define retention, purpose, and privacy controls for installation and source-attribution telemetry.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (39)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill also documents uninstall logic, token revocation, skill inventory inspection, and deletion/modification of local state files, none of which are implied by the declared content-generation purpose. Hidden lifecycle-management capabilities can be abused to tamper with local configuration, disrupt other skills, or manipulate authentication state on the host.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill also documents uninstall logic, token revocation, skill inventory inspection, and deletion/modification of local state files, none of which are implied by the declared content-generation purpose. Hidden lifecycle-management capabilities can be abused to tamper with local configuration, disrupt other skills, or manipulate authentication state on the host.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill also documents uninstall logic, token revocation, skill inventory inspection, and deletion/modification of local state files, none of which are implied by the declared content-generation purpose. Hidden lifecycle-management capabilities can be abused to tamper with local configuration, disrupt other skills, or manipulate authentication state on the host.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
run. Use only this package's bundled `scripts/mcp_client.py` to reach

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
run. Use only this package's bundled `scripts/mcp_client.py` to reach

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md
run. Use only this package's bundled `scripts/mcp_client.py` to reach

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
run. Use only this package's bundled `scripts/mcp_client.py` to reach

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 68)May include surrounding context.

json
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The authorization flow enables capabilities materially broader than the manifest-style description of generating Xiaohongshu beauty content. In context, requesting spending and broad generation permissions creates a dangerous mismatch between user trust and actual authority, increasing the blast radius if the skill or its backend is abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill requests a very broad OAuth scope set including images, videos, music, speech, voice management, artifact/task access, and wallet spending, which is far beyond a beauty note maker's described function. This violates least privilege and means a compromise, misuse, or deceptive deployment of the skill could grant capabilities unrelated to user expectations, including financial actions via wallet:spend.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The client contains a full self-update framework that downloads manifests and archives from remote infrastructure and replaces local installation files, including its own code, even though the skill is presented as a beauty-note generator. That creates a broad supply-chain and self-modifying-code risk surface unrelated to the advertised function; if the update channel or signing assumptions fail, arbitrary code can be introduced into the agent environment.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The exposed update command advertises and enables self-modification of the installed package, which is dangerous in an agent skill whose declared purpose is unrelated to software maintenance. Self-modifying capability materially increases supply-chain risk and can turn a content tool into a code-delivery mechanism if the update channel is abused.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares no explicit tool scope or permission boundaries while its documented capabilities imply access to environment data, filesystem, shell, and networked execution through the bundled client. For a content-writing skill, that gap is dangerous because users and hosts cannot readily constrain what the skill may do, increasing the blast radius if the client is misused or compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation explicitly introduces silent automatic self-updating for a skill whose stated purpose is copy generation and optional research. Silent code replacement creates a supply-chain risk: the executable behavior can change after installation without fresh review or user approval, potentially introducing malicious logic, broader permissions, or data-handling changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Automatic installation/update behavior is not clearly surfaced in the main skill description even though it materially changes trust assumptions and local system risk. Users may install a beauty-note skill expecting static text generation, while in reality it can download and replace code on disk, expanding exposure to supply-chain compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json
"icon": "https://beatra.ai/textures/icons/zhongcao-beauty-note-maker-0.1.1.png",
  "localized": {
    "en": {
      "description": "Create Xiaohongshu beauty and skincare content from product facts, routine steps, skin concerns, and audience context. This AI beauty note maker produces a 3:4 post concept, review structure, usage-scene copy, title options, cover wording, relevant hashtags, and a natural comment starter for makeup, skincare, haircare, body care, routines, comparisons, and product recommendations. Optionally it reads Xiaohongshu itself — the notes already running for the topic, one page of a note's top comments, and an account's own recent notes — so Xiaohongshu research, competitor note analysis and comment analysis rest on the platform instead of on guesswork.",
      "display_name": "Zhongcao Beauty Note Maker",
      "summary": "Turn beauty or skincare facts into a Xiaohongshu 3:4 note concept with review copy, usage scenes, titles, cover wording, and hashtags.",
      "tags": [

Static analysis

No suspicious patterns detected.