Back to skill

Security audit

Zhongcao OOTD Lookbook Maker

Security checks across malware telemetry and agentic risk

Overview

The skill's lookbook function is real, but it also asks for broad Beatra account authority and silently self-updates local package files, so it needs Review before installation.

Install only if you are comfortable giving this Beatra skill broad account permissions, allowing selected outfit files to be uploaded for remote processing, and allowing package telemetry plus a silent default update mechanism. If installed, consider disabling automatic updates with the documented update --auto off command and review Beatra account/device access in the Beatra Console.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares no permissions while its documented behavior requires environment access, file read/write, network communication, and shell execution. That mismatch prevents informed consent and undermines policy controls, especially because the skill can upload local files, store credentials, and invoke a bundled client for remote actions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The public description frames the skill as a lookbook/content tool, but the documentation reveals additional sensitive behaviors: OAuth/device auth, local credential storage, arbitrary file upload, installation registration, uninstall-side token revocation, and self-update/package replacement. This is dangerous because users may authorize a creative tool without realizing it can alter local state, handle bearer tokens, and transmit local artifacts to a third party.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill includes a self-updating mechanism that downloads and replaces package files, which is unrelated to the core lookbook-making function. Even with stated integrity checks, silent remote code/content replacement expands the trust boundary and creates a supply-chain risk if the update channel, signing process, or package source is ever compromised.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest presents a content-creation/research skill, but later documentation adds automatic remote update checks and local file replacement. Hidden operational capabilities like this are risky because they allow ongoing remote influence over the installed skill beyond the user's reasonable expectation of a static creative tool.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The documentation describes automatic outbound installation registration that sends package, version, platform, and installation reference data, which is unrelated to the skill's user-facing fashion/OOTD purpose. Even if labeled non-billable and non-secret, this is still telemetry and creates an undisclosed data flow that can expose environment and usage metadata without clear necessity or user consent.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The file documents resolving the 'real agent environment' from environment signatures or a host file, which amounts to environment fingerprinting. For a fashion lookbook skill, this capability is not justified by the stated purpose and increases privacy and tracking risk by enabling consistent host identification across uses.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The authorization helper requests a very broad OAuth scope set including artifacts, images, videos, music, speech, wallet spending, and task controls, which materially exceeds the apparent needs of an OOTD lookbook skill. Excessive scopes violate least-privilege and increase blast radius: if the token is misused or stolen, an attacker could access unrelated capabilities and spend resources far beyond outfit-image generation.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill metadata presents a Xiaohongshu lookbook/research use case, but this file performs Beatra device authorization with broad platform scopes and local tracking of installation state. That mismatch can mislead users about what access is being granted and what data is being stored, weakening informed consent and increasing the chance users approve unexpectedly powerful credentials.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The client implements a full remote self-update pipeline that downloads manifests and archives, validates them, and then replaces local package files on disk. Even with integrity checks, this materially expands the trust boundary for a fashion lookbook skill into software deployment behavior; compromise of the vendor update channel, signing/discovery process, or backend control would permit code replacement on the user's machine.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill records a device-local skill inventory and sends installation telemetry such as package slug, version, platform, and external installation reference to a remote service. For an outfit lookbook maker, this exceeds the stated creative function and creates privacy and tracking risk, especially because it runs best-effort on use rather than as narrowly scoped, user-initiated diagnostics.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code fingerprints its host environment by inspecting environment variables and host.json to classify the platform (for example, Claude Code or Codex). This creates unnecessary environmental metadata collection for a fashion-content tool and can support user/device profiling or backend behavior differentiation unrelated to the advertised functionality.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The uninstall script is able to delete shared state files under ~/.beatra, including credentials and inventory used by other skills. Even though the code tries to avoid revoking while other skills remain, any bug, corrupted inventory, or unexpected path/state condition could remove shared local state and disrupt unrelated skills on the device.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
Automatic updates occur without separate confirmation and modify local skill files, which means remote changes can be introduced after initial trust is granted. This weakens user control and creates a meaningful supply-chain exposure, particularly for a skill that also has shell, file, and network capabilities through its bundled client workflow.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The document states that the client silently checks for updates and automatically installs them by default before ordinary commands, without separate confirmation. Even with integrity and source validation controls, modifying local files implicitly can violate user expectations, create change-management risk, and expand the blast radius if the trusted update channel is ever compromised or misconfigured.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation indicates that installation and environment-related data is transmitted on first use, but the skill metadata and purpose statement do not prominently warn users about this behavior. Hidden or weakly disclosed telemetry is dangerous because users may unknowingly expose system and usage metadata to a backend unrelated to the expected creative task.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The workflow instructs the agent to upload local outfit photos to a remote image service but does not require an explicit user warning or consent step about external data transmission. Because outfit photos can contain personal images, location clues, metadata, or other sensitive information, this creates a real privacy risk, especially when the skill optionally performs additional remote platform research.

Missing User Warnings

Low
Confidence
77% confidence
Finding
The code writes detected host platform and device hostname to host.json without any explicit notice in this file. While low severity, undisclosed collection/persistence of host metadata can expose environment details useful for profiling the user system or correlating installations across tools.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The code records a local inventory of installed skills including slug, platform, and resolved installation path in ~/.beatra/skills.json without explicit disclosure. Installation paths can reveal usernames, directory structures, and development/workflow details, creating unnecessary privacy exposure if local files are later accessed or exfiltrated.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
maybe_auto_update() silently performs network discovery, downloads update artifacts, and applies file replacements during normal command execution without contemporaneous user warning. Silent code changes in a skill that should primarily create lookbooks are dangerous because they bypass user expectation and increase the chance that a compromised update channel or mistaken release results in unreviewed code execution on subsequent runs.

Credential Access

High
Category
Privilege Escalation
Content
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",
Confidence
88% confidence
Finding
Referencing credentials.json within a skill package indicates the package can reach shared authentication material. In this script the token is used for revocation rather than exfiltration, but granting a content-focused skill direct credential-file access increases blast radius if the package is modified, compromised, or repurposed.

Credential Access

High
Category
Privilege Escalation
Content
def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):
Confidence
93% confidence
Finding
This function parses ~/.beatra/credentials.json and extracts an access token, giving the skill code direct access to shared bearer credentials. Even though the present logic uses the token only to revoke the device, direct token access is dangerous because any future code path or compromise could reuse it for unauthorized API activity affecting other installed skills.

Self-Modification

High
Category
Rogue Agent
Content
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",
Confidence
97% confidence
Finding
The presence of a self-update command confirms that this client is designed to modify its own installed code. Self-modification is risky in this skill context because the advertised purpose is fashion image/post generation, yet the code has software lifecycle control capabilities that can change future execution behavior and broaden the impact of any backend or supply-chain compromise.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.