Security audit
Security checks for vulnerabilities and agentic risk
Review is recommended because this photo editor requests shared spending access and unrelated video, music, speech, and voice permissions.
Install only if you accept shared spending and unrelated media/voice access. Approve each priced edit, upload only photos you intend Beatra to process, and account for automatic installation telemetry. Revoke the device in Beatra Console when access is no longer needed.
scripts/mcp_client.pyPaid submissions lack an enforced per-request approval gate
A direct call can submit a billable image-edit task before the user approves its particular inputs and cost. Actual charges and task acceptance depend on the remote service.
The reported video, music, speech, and voice permissions exceed the authority needed for photo cleanup, creating a least-privilege violation if granted. Spending authority is consistent with the explicitly paid workflow, but combining it with unrelated generation and voice capabilities could amplify credential compromise or agent misuse; per-call confirmation instructions do not enforce backend authorization boundaries.
The supplied code is an authorization and installation cleanup utility, not an image-editing implementation. It does not load photos, accept object selections, perform inpainting, or return retouched images. Although an uninstaller can support a larger photo-editing package, this chunk's substantive credential access, remote authorization revocation, and shared-state deletion are capabilities not represented in the declared purpose. The code includes safeguards to preserve connections used by other skills, but those safeguards do not resolve the description–behavior mismatch.
The reported automatic transmission of a persistent installation reference and detailed environment metadata creates a privacy exposure beyond the photo-editing task, without clear disclosure or consent in the supplied document. Registration is mentioned, but its analytics payload is not explained; a general-purpose client and regular-file upload support are not independently vulnerabilities unless unauthorized operations or file selection are possible.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
and keeps checking through brief network failures. One run waits up to
about 15 minutes; an approval page stays open for up to an hour;
5. atomically saves the returned Device Token to
`~/.beatra/credentials.json` without printing an HTTP response body;
6. validates the new credential with the same non-billable MCP request and
prints `Beatra is ready` only after it succeeds.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
the file ACL. Never copy the Device Token into conversation context, stdout,
stderr, a command argument, an environment variable, a log, a backup, a diff,
or another file. A completed authorization leaves the token only in
`~/.beatra/credentials.json`.
## Ensure Beatra is ready
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#: is empty — the script never recursively deletes a directory it does not
#: fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
# Updates and security
Since the October 2026 releases, Beatra Skill packages contain no self-updater.
Earlier releases could replace their own files from Beatra's CDN; that code has
been removed. Updates now come only from the store or tool you installed the
Skill from.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
These files are written under `~/.beatra/`. On POSIX that directory is mode
0700. Nothing is written inside the installed Skill directory.
- `credentials.json` (POSIX mode 0600), written by `scripts/authorize.py`: the device credential.
- `installation.json` (POSIX mode 0600), written by `scripts/authorize.py`: the stable installation reference.
- `host.json` (POSIX mode 0600), written by `scripts/authorize.py`: the agent environment, and a device name when one is known.
- `network.json` (POSIX mode 0600), written by `scripts/mcp_client.py`: this computer's network route.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
When `scripts/uninstall.py` decides this is the last Beatra skill on the
computer, it first asks Beatra to revoke the device credential when one is
stored. If Beatra refuses, it changes nothing so the run can be repeated.
Otherwise it unlinks exactly these names in `~/.beatra/`: `credentials.json`,
`installation.json`, `host.json`, `skills.json`, `registrations.json`,
`network.json`, `balance-holds.json`, `pending_authorization.json`, and
`.authorize.lock`. It also unlinks `state.json`, `registration.json`, and
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _existing_credential(state_dir: Path) -> Path | None:
path = state_dir / "credentials.json"
try:
path_stat = os.lstat(path)
if not stat.S_ISREG(path_stat.st_mode):
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
with _SIGNALS.deferred():
_atomic_json(
credential_path,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _credentials(state_dir: Path) -> tuple[str, str]:
state_dir = state_dir.expanduser()
path = state_dir / "credentials.json"
if not path.is_file():
# Not connected yet (or the file is gone): the caller may still find
# an approval waiting to be collected.
The photo-cleanup skill requests unrelated video, music, speech, and voice-management permissions alongside spending and artifact/task access. Its shared credential and exact full-scope checks institutionalize this excessive authorization, increasing the potential for unauthorized spending, voice modification, or access to unrelated resources if the token or a consuming skill is compromised; this file does not demonstrate actual misuse.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
The documented authorization covers video, music, speech, and other tools beyond the photo-cleanup functionality requested by this skill. This violates least privilege and increases the capabilities available through a compromised client or stolen token, although actual server-side permissions cannot be verified from this document.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The workflow directs the agent to upload the user's photo without first explaining the external processing destination or obtaining informed approval for that transfer. Photos can contain faces, private surroundings, documents, or embedded location metadata; approval for a later paid edit does not necessarily authorize the earlier upload. External image processing is expected for this skill, which reduces suspicion of malicious exfiltration, but the workflow leaves a privacy disclosure and consent gap.
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
A region focuses intent but does not guarantee that pixels outside it are untouched. Review the delivered image for drift outside the box rather than assuming there is none, and never tell the user a nearby face, product, or line of text is guaranteed safe.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.