zhongcao-food-note-maker

• Outcome: Review
• Latest audit: Aug 20, 2026 · 10:50 AM UTC
• Version: 0.1.2

Overview

The skill is largely coherent for creating REDnote food posts, but it requests a broad shared Beatra credential and silently self-updates local package files, so users should review it before installing.

Install only if you are comfortable granting Beatra a shared local credential with broad media and wallet-spend scopes, allowing source images to be uploaded for generation, sending package/platform registration telemetry, and accepting default-on silent package updates. Consider disabling automatic updates with the documented update --auto off command and revoking the Beatra device authorization when you no longer use the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs use of shell, network, file read/write, and environment-backed operations while declaring no permissions, which creates a transparency and consent gap for a user or host evaluating risk. In this context, the capability set is significant because the skill also performs remote calls, uploads local files, stores state, and updates itself, so missing permission disclosure can lead to unexpected data access or system modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is food-post generation and optional Xiaohongshu research, but the skill also includes authentication flows, persistent credential handling, generic MCP tool invocation, file upload, telemetry/registration, uninstall logic, and package self-update. That mismatch is dangerous because it broadens trust far beyond the advertised use case, increasing the chance that users authorize a content tool that can actually modify local state, transmit data, and invoke broader remote functionality.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The skill first promises outputs only from user-supplied facts, then later authorizes direct Xiaohongshu lookups and use of retrieved figures. This inconsistency can mislead users about provenance and privacy expectations, causing external data to be incorporated when the user believed the output would remain grounded only in their provided inputs.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OAuth scope string requests a very broad set of capabilities, including artifact access, task control, media generation, voice management, and wallet spending, far beyond what a food-note image/post creation skill should need. Excessive permissions violate least privilege and materially increase blast radius if the skill, its stored token, or the upstream service is abused or compromised.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The scope list includes `music:generate`, `speech:generate`, `voices:read`, and `voices:write`, which do not align with the stated purpose of generating food-note imagery and captions. Unnecessary audio and voice permissions expand attack surface and could allow misuse of account-linked voice assets or unexpected content generation under the user's identity.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The scope list includes `music:generate`, `speech:generate`, `voices:read`, and `voices:write`, which do not align with the stated purpose of generating food-note imagery and captions. Unnecessary audio and voice permissions expand attack surface and could allow misuse of account-linked voice assets or unexpected content generation under the user's identity.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The client implements a full self-update system that downloads manifests and archives, validates them, and replaces local installation files, which is unrelated to the advertised food-note generation purpose. Even with checksum and path validation, this materially expands the attack surface: compromise of the vendor update channel, signing/checksum publication pipeline, or package endpoint would allow remote code replacement on the user's machine.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code records local skill inventory and sends installation-registration telemetry that is not necessary for creating food-related posts. This creates privacy and behavioral-tracking risk by collecting package presence, install paths, platform data, and installation references beyond the skill's described function.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill fingerprints the host environment by inspecting environment variables and host.json to infer which agent/platform is running it. That information is not needed for food-note generation and can be used for tracking, environment-specific targeting, or tailoring follow-on behavior to the execution context.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill discloses automatic self-update, including download and replacement of package-owned files, but this system-modifying behavior is not prominently surfaced in the main description or framed as a high-risk action requiring trust. Even with integrity checks, automatic code replacement materially changes the local execution environment and expands supply-chain risk if update channels or trust roots are compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly states that the client silently checks for updates and automatically installs newer releases without separate confirmation. Even with integrity checks, this creates a supply-chain and user-consent risk because executable/package files can be replaced during ordinary use without an explicit approval step at the time of change, increasing the blast radius if the update channel, signing process, or publisher workflow is ever compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file states that the bundled client automatically makes a registration call on first use and writes a local cache, but the skill metadata/description does not clearly warn users about this behavior. Silent outbound registration and local state creation can surprise users, undermine informed consent, and create privacy/compliance issues, especially in environments that expect tools to be offline unless explicitly disclosed.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The client performs best-effort silent automatic updates before normal commands, modifying installed package files without a user-facing warning at the moment of execution. Silent mutation of local code reduces user control and makes supply-chain compromise more dangerous because updated code can start running on subsequent invocations without informed approval.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Installation telemetry is sent automatically as part of session setup/registration without meaningful user-facing disclosure in this file. Automatic background reporting of installation identifiers and platform context creates avoidable privacy risk and is inconsistent with the narrow creative purpose described for the skill.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: Exposing self-update/self-modification capability in a client for a food-note skill is dangerous because it allows the package to replace its own local code outside the host's normal trust and review path. In this skill context, that behavior is especially suspicious because it is unrelated to the stated media-generation purpose and increases the blast radius of any upstream compromise.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.