Security audit
Security checks for vulnerabilities and agentic risk
This photo-cleanup skill is not clearly malicious, but it grants broad Beatra account access and silently updates itself beyond what a simple object-removal tool needs.
Install only if you are comfortable giving this Beatra package broad shared account access, sending photos to Beatra for processing, and allowing default silent package updates. Before use, consider disabling automatic updates with the documented command and review the Beatra account permissions and stored ~/.beatra credential lifecycle.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",No suspicious patterns detected.