Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Beatra media-generation workflow, but it uses a broad shared token and silently self-updates package code by default, which merits careful review before installation.
Install only if you are comfortable giving Beatra a shared device token with spend and media-generation authority, allowing this package to auto-update itself by default, and sending limited installation/runtime registration data. Consider disabling automatic updates with the documented `update --auto off` command and review Beatra account spending controls before using paid generation.
The package references uninstall and credential-revocation behavior that reads and modifies local state under user directories, despite presenting as a comic-generation skill. Blending destructive or state-altering maintenance operations into a content-creation skill raises the risk of unauthorized deletion, credential disruption, or environment tampering if invoked unexpectedly.
The package references uninstall and credential-revocation behavior that reads and modifies local state under user directories, despite presenting as a comic-generation skill. Blending destructive or state-altering maintenance operations into a content-creation skill raises the risk of unauthorized deletion, credential disruption, or environment tampering if invoked unexpectedly.
The package references uninstall and credential-revocation behavior that reads and modifies local state under user directories, despite presenting as a comic-generation skill. Blending destructive or state-altering maintenance operations into a content-creation skill raises the risk of unauthorized deletion, credential disruption, or environment tampering if invoked unexpectedly.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The helper requests a very broad OAuth scope set, including wallet:spend, music/speech/voice generation, and task/artifact capabilities that exceed the stated purpose of generating comic-drama shots. If the user approves, the skill gains unnecessary privileges, increasing blast radius for account abuse, unauthorized spending, data access, and misuse well beyond comic-image/video generation.
The skill implements a full self-update mechanism that downloads code from remote endpoints and mutates the local installation on disk, behavior that exceeds the stated comic-shot generation purpose. Even with integrity checks, this creates a remote code replacement channel inside a skill runtime, increasing supply-chain risk and enabling unexpected persistence or capability expansion if the update service, signing pipeline, or distribution account is compromised.
Exposing a self-update command inside the skill gives the package authority to replace its own code and persist new behavior locally, which is unnecessary for the described comic-shot workflow. In the context of an agent skill, self-modification materially raises risk because future executions may run altered code outside the user's review path, especially if the remote update channel is ever compromised.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope even though it instructs use of shell, local file access, network access, and package modification paths via the bundled client. Without a restrictive permission boundary, a host agent may grant broader capabilities than users expect, increasing the blast radius if the client or workflow is abused.
Embedding package self-update/install behavior inside a media-generation skill introduces an unnecessary supply-chain risk path unrelated to the core task. Even with checksum and origin validation claims, automatic replacement of package-owned files expands the attack surface and can change behavior over time without the user expecting a creative tool to modify itself.
The skill states that newer releases install without separate confirmation, but this capability is not clearly surfaced in the user-facing purpose statement. Silent code replacement reduces user control and can undermine review, reproducibility, and trust, especially for a skill that already uses network, shell, and local file capabilities.
The changelog states that users in mainland China are routed through a specific mainland network, with an alternate international sign-in path only if needed. This is a locale-specific behavior described without an explicit user choice or opt-in, which can violate language/locale policy expectations for neutral defaults.
The document states that the client silently checks for updates and automatically installs them by default without separate confirmation. Even though the text describes integrity checks and rollback protections, silent self-update with file replacement and network activity can materially affect a local installation without clear up-front warning or explicit opt-in, creating a real user-consent and change-control risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The document describes an automatic installation-registration telemetry call that collects package, platform, stable installation reference, network route, install source, locale, and coarse runtime metadata unrelated to the core purpose of generating comic-drama shots. Even if the fields are described as non-sensitive individually, this creates persistent cross-installation tracking and environment fingerprinting without a clear functional necessity for the skill, which increases privacy and supply-chain risk if the endpoint, retention, or access controls are weak.
The code records a persistent local inventory of installed skills, including install paths and platform metadata, in a shared state directory. That behavior is not obviously necessary for comic-shot generation and creates avoidable local telemetry that could reveal user environment details, installed tooling, and filesystem layout to other local processes or future code in the same ecosystem.
No suspicious patterns detected.