zhongcao-note-copywriter

• Outcome: Review
• Latest audit: Aug 20, 2026 · 10:43 AM UTC
• Version: 0.1.3

Overview

The skill performs the advertised Xiaohongshu copy and cover workflow, but installation grants broad Beatra account powers and silent self-updates that go beyond that narrow purpose.

Review this carefully before installing. Use it only if you are comfortable granting a shared Beatra device token with wallet-spending and broad media/tool authority, sending package/platform registration metadata to Beatra, and allowing package files to update automatically. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off` and revoking the Beatra device token when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises a content-writing workflow but invokes a bundled Python client, reads reference files, performs network calls, stores state, and can update itself. Having these code-capable behaviors without an explicit permission declaration weakens reviewability and informed consent, making it easier for users or hosts to authorize a skill whose effective privileges are much broader than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: There is a substantial mismatch between the stated purpose and the documented runtime behavior: OAuth/device auth, persistent credential storage, arbitrary Beatra tool invocation, uploads, telemetry/registration, uninstall cleanup, and auto-update all extend far beyond simple copywriting and image generation. That mismatch increases the chance that operators approve or execute the skill without understanding its trust boundary, which is a classic security and transparency failure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill includes runtime self-updating package installation even though its declared function is Xiaohongshu copywriting/research. Self-modifying or self-replacing behavior materially changes the software after review time, creating supply-chain and trust risks because future behavior may differ from what was initially inspected.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatic update capability is not necessary for the skill's stated business purpose and broadens the attack surface without user benefit proportional to the risk. Any mechanism that downloads and installs new code at runtime can be abused through compromise of the vendor, distribution path, or update logic, even if integrity checks are claimed.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The OAuth scope request is far broader than the skill’s stated copywriting and Xiaohongshu research purpose. Requesting images, videos, music, speech, voice management, artifact access, task control, and wallet spending creates unnecessary privilege and materially increases the blast radius if the credential is stolen, misused, or the backend/tooling is compromised.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The script requests speech, voices, music, and video generation permissions that do not match the skill’s advertised copywriting/research role. Even if unused, overbroad creative-generation scopes can be abused for unauthorized content generation, quota consumption, or lateral access to unrelated platform capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script requests speech, voices, music, and video generation permissions that do not match the skill’s advertised copywriting/research role. Even if unused, overbroad creative-generation scopes can be abused for unauthorized content generation, quota consumption, or lateral access to unrelated platform capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 77% confidence
• Finding: The script persists host platform, device name, and local install path inventory data that exceed what is strictly necessary to generate notes. While this looks intended for inventory and operational management rather than exfiltration, it increases local privacy exposure and creates extra sensitive metadata that could aid profiling or post-compromise reconnaissance.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The client contains broad self-update and installation-management logic unrelated to a Xiaohongshu copywriting/research skill, greatly expanding trust and attack surface. Even with checksum and path checks, bundling privileged code replacement behavior into a content-generation skill creates a supply-chain risk: compromise of the update channel or publisher account can silently replace local code.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill fingerprints the host environment using environment variables and local state, then injects source_package_slug and source_platform into tool calls. For a copywriting skill, this is unnecessary metadata collection that can enable user/device profiling, cross-session correlation, and backend-side segmentation beyond the declared functionality.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill maintains a local inventory of installed skills and performs remote installation registration/telemetry on use, which is unrelated to the advertised copywriting purpose. This creates unnecessary privacy exposure and broadens the consequences of backend compromise by disclosing package presence, install paths, platform, and timestamps.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that newer releases install automatically without separate confirmation, but this is disclosed deep in the document rather than as a prominent warning adjacent to normal usage. That undermines meaningful consent and can cause users to trigger network/download/install behavior they did not reasonably expect from a copywriting skill.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that the client silently checks for and automatically installs newer releases by default without separate confirmation. Even with integrity checks and pinned sources, silent code replacement expands the trust boundary and can lead to unexpected execution of new code, which is risky in an agent skill context where users may not anticipate local file changes during normal use.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document describes an automatic outbound registration call on first use that transmits package slug, version, platform, and a stable external installation reference, but it does not present an explicit user-facing warning or consent mechanism. Even if the data is described as non-secret and non-billable, it is still telemetry-like behavior that can surprise users, create privacy/compliance issues, and weaken trust if performed silently.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: maybe_auto_update() performs silent best-effort updates that can modify the local installation during normal command execution without user-facing warning or approval. In the context of a copywriting skill, covert code mutation is especially risky because users would not reasonably expect content tooling to rewrite its own executable files, making supply-chain compromise harder to detect.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 97% confidence
• Finding: The presence of a self-update command indicates the package is designed to replace its own installed code. Self-modifying behavior is dangerous in a user-facing creative skill because it creates a direct path for remote code changes, increases supply-chain impact, and undermines user expectations about what the skill will do locally.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.