Security audit
Security checks for vulnerabilities and agentic risk
The audiobook workflow is real and well documented, but it uses a broad shared Beatra token and silently self-updates local skill code by default, so it belongs in Review before installation.
Install only if you are comfortable with Beatra storing a shared local device token, using that token for paid generation workflows, sending limited installation/runtime registration data, and allowing this skill to update its own package files automatically unless you turn auto-updates off with the documented command.
The skill's advertised function does not mention uninstall logic, inspection of installed skill inventory, credential revocation, or deletion of local state under ~/.beatra. These destructive or account-affecting operations are materially different from audiobook generation and could surprise users or be abused to disrupt local configuration and access.
The skill's advertised function does not mention uninstall logic, inspection of installed skill inventory, credential revocation, or deletion of local state under ~/.beatra. These destructive or account-affecting operations are materially different from audiobook generation and could surprise users or be abused to disrupt local configuration and access.
The skill's advertised function does not mention uninstall logic, inspection of installed skill inventory, credential revocation, or deletion of local state under ~/.beatra. These destructive or account-affecting operations are materially different from audiobook generation and could surprise users or be abused to disrupt local configuration and access.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
format, sample rate if set, speed, volume, pitch, and emotion if set;
- the live pricing basis, formula, unit price or range, and estimated credits;
and
- a clear statement that approval creates exactly the listed paid requests.
Wait for explicit approval of that current card. Do not add a second
confirmation when the user has already approved the exact current card. Every
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
The skill documentation instructs all packages to share a single full-scope device token from ~/.beatra/credentials.json, creating a broad credential-sharing model across packages. If any package or tool in this ecosystem is compromised, it can potentially reuse that token to access MCP services with the user's full privileges, turning one package compromise into account-wide impact.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization helper requests a very broad OAuth scope set, including wallet spending and multiple generation capabilities unrelated to simple audiobook narration setup. If the issued token is compromised or the skill is abused, it could authorize costly actions, broader data access, or capabilities far beyond user expectations for this skill.
The script stores a bearer access token in plaintext JSON under ~/.beatra/credentials.json. Even with restrictive POSIX permissions, plaintext bearer tokens are valuable secrets; compromise of the local account, backups, logs, or endpoint tooling could allow reuse of the token with the broad scopes requested by this skill.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
with _SIGNALS.deferred():
_atomic_json(
credential_path,
The skill exposes built-in self-modification through its update command and also triggers automatic updates in normal operation. Self-updating code is dangerous in agent contexts because it permits remote post-installation code changes, undermines static review of the shipped skill, and expands the consequences of backend compromise or release-process abuse.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope even though its instructions require shell execution, network access, file reads/writes, and environment interaction via a bundled Python client. That over-broad implicit capability increases the chance of unintended or abusive operations because the host cannot constrain the skill to only the minimum privileges needed.
The skill includes self-updating and package replacement behavior unrelated to its primary audiobook function. Any self-update mechanism that can modify local files expands the trust boundary and creates supply-chain risk, especially when embedded in a content workflow users may not expect to alter installed code.
Automatic updates and local file replacement are enabled by default without prominent disclosure in the main skill description. This is dangerous because users may invoke a narration workflow unaware that it can download and replace package-owned files, changing future behavior without clear consent at first use.
The manifest provides localized content only for English, Japanese, and Chinese, and the Japanese and Chinese descriptions explicitly constrain the skill to completed Japanese or Chinese manuscripts respectively. This indicates a language-specific experience without any stated user opt-in or language choice policy, which can violate locale/language neutrality requirements unless clearly justified as region-specific.
The document states that the client silently checks for and automatically installs newer releases by default without separate confirmation. Even with integrity checks and fixed update sources, unattended modification of local executables/files increases supply-chain and operational risk because a compromised publisher pipeline, signing/checking flaw, or unexpected update can change user systems without an explicit approval step.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The documentation describes a built-in outbound registration call that transmits installation metadata, network route information, install source, and coarse host/runtime fingerprints. For an audiobook narration skill, this collection is not necessary to perform the stated function, creates undisclosed tracking/privacy risk, and expands the attack surface through unsolicited network communication.
This file specifies collection of network route, install source, OS/version, architecture, Python version, interface language, and timezone offset, which together form a meaningful device fingerprint unrelated to audiobook generation. Such telemetry can enable user or installation tracking across environments and is especially concerning because it occurs automatically on first use and periodically thereafter.
No suspicious patterns detected.