zhongcao-carousel-maker

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:45 AM UTC
• Version: 0.1.3

Overview

The carousel workflow is real, but the skill also requests broad Beatra account authority and silently updates its local code by default.

Review this before installing if you require strict change control or least-privilege tokens. Disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if you do install it, and only authorize the Beatra device token if you are comfortable granting the broader shared Beatra media and billing capabilities described in the docs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while its documented behavior clearly requires sensitive capabilities including network access, shell execution, file read/write, and environment access. This undermines informed consent and host-side policy enforcement because users and platforms cannot accurately assess what the skill is able to do before installation or execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description presents a content-creation and research workflow, but the file also documents OAuth device authorization, persistent credential storage, arbitrary Beatra tool access through an MCP client, local file uploads, self-update behavior, registration/telemetry, and credential inventory tracking. This mismatch is dangerous because it conceals materially broader trust and attack surface than users would reasonably expect, increasing the risk of credential abuse, data exfiltration, or unauthorized code changes.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill includes an automatic self-updating mechanism that installs newer code during normal command execution, which is unrelated to the core task of generating carousel content. Even if limited to official sources and integrity-checked, this creates a remote code modification path that expands the trust boundary and can be abused if the update channel, signing process, or package ownership model is compromised.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The OAuth scope set is far broader than the described carousel-making and optional Xiaohongshu research functionality. It requests wallet spending plus image, video, music, speech, voice, artifact, and task capabilities, so authorizing this skill grants access well beyond user expectations and violates least-privilege; if the skill or its backend is compromised, those excess permissions could be abused immediately.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The authorization flow enables capabilities not described by the skill metadata, including spending and multiple media-generation permissions unrelated to a carousel-focused tool. This creates a dangerous mismatch between the advertised behavior and the privileges granted, increasing the blast radius of any misuse or compromise.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The client includes substantial behavior unrelated to the advertised carousel-making and Xiaohongshu research function, including package self-update, installation registration, inventory recording, and background network communication. This broadens the trust boundary and creates unexpected code execution and telemetry pathways that users would not reasonably infer from the skill description.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code fingerprints the host environment by inspecting agent-specific environment variables and persisting platform attribution. For a content-generation skill, collecting and transmitting host platform identity is unnecessary and increases privacy risk and the amount of contextual data exposed to the backend.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill records local installation inventory and performs registration telemetry on each use, which is unrelated to generating carousels or researching Xiaohongshu content. This creates persistent local tracking and external reporting of installed skills and paths, expanding privacy and surveillance risk without clear necessity.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented automatic update behavior installs and replaces package files without separate confirmation, but the user is not prominently warned about the system impact at the point of use. Silent code replacement reduces user control and makes it easier for unexpected behavior changes or supply-chain issues to affect the environment without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The manifest explicitly states the skill may read Xiaohongshu notes, top comments, and an account's recent notes, but it does not disclose this external data access as a user-facing warning or consent boundary. This creates a privacy and transparency risk because users may invoke the skill expecting image generation only, while the skill can also pull third-party or account-linked platform data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manifest declares device-bearer authentication and a local credential file, but gives no user-visible notice that local credentials will be used to authenticate outbound requests. This is dangerous because it obscures trust boundaries and could lead users to authorize network actions under stored credentials without informed consent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that the client silently checks for updates and automatically installs them by default without separate confirmation. Even though the text describes verification controls, silently modifying a local installation can violate user expectations, create change-control risk, and expand the blast radius if the update mechanism or trust root is ever compromised.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The document states that first use triggers a best-effort registration call sending package slug, version, platform, and a stable external installation reference, but the skill metadata shown to users does not disclose this outbound telemetry. Even if the data is described as non-secret and non-billable, undisclosed transmission of environment and installation metadata reduces transparency and can violate user expectations or organizational policy.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The client can silently auto-update itself and replace installation files during normal command execution without an interactive user warning or approval. Even though it performs checksum and manifest validation, this still grants the remote distribution channel ongoing ability to change local executable code, which is especially risky in a skill whose stated purpose does not require self-modifying behavior.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 98% confidence
• Finding: The package exposes a self-update mechanism that downloads and replaces its own code, effectively enabling self-modification. In the context of a content-creation skill, this is dangerous because compromise of the vendor update infrastructure, release pipeline, or discovery endpoint could convert ordinary skill use into remote code deployment on the local installation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.