Security audit
Security checks for vulnerabilities and agentic risk
The skill does photo restyling, but it also requests broad Beatra account permissions and silently self-updates local code by default.
Install only if you are comfortable granting Beatra a shared credential that can cover more than photo restyling, including wallet-spend and other media capabilities. Consider disabling automatic updates immediately after install, and review Beatra console/device revocation controls before using it with sensitive photos or an account balance.
scripts/authorize.py:34Image-restyling Skill requests a shared bearer token with excessive cross-media and wallet privileges
scripts/mcp_client.py:969Silent self-updater retrieves and installs remotely changeable executable Skill code
scripts/authorize.py:362Authorization helper collects and transmits the local hostname without a dedicated opt-out
The skill documentation for a creative image tool also covers uninstall flows, local state mutation under ~/.beatra, credential access, token revocation, and package lifecycle management. Embedding administrative and credential-sensitive operations in a consumer-facing art skill is risky because it expands the blast radius from media processing into account, host, and installation management.
The skill documentation for a creative image tool also covers uninstall flows, local state mutation under ~/.beatra, credential access, token revocation, and package lifecycle management. Embedding administrative and credential-sensitive operations in a consumer-facing art skill is risky because it expands the blast radius from media processing into account, host, and installation management.
The skill documentation for a creative image tool also covers uninstall flows, local state mutation under ~/.beatra, credential access, token revocation, and package lifecycle management. Embedding administrative and credential-sensitive operations in a consumer-facing art skill is risky because it expands the blast radius from media processing into account, host, and installation management.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization scope is far broader than the skill's stated purpose of photo restyling. Requesting wallet spending, task control, voice, speech, music, and video permissions violates least privilege and would let a compromised or misused skill access unrelated capabilities and potentially incur charges or manipulate user resources.
This client contains extensive package lifecycle logic—discovery, download, verification, extraction, rollback, locking, and file replacement—despite the skill being presented as a photo restyling tool. Even though there are integrity checks, bundling autonomous installation-management behavior into a creative skill materially expands attack surface and gives remote infrastructure the ability to change local code over time, which is especially concerning when updates may occur automatically.
The CLI exposes explicit self-update functionality for the installed package, enabling the skill to replace its own code on disk. In the context of a photo-restyling skill, self-modification is unnecessary and dangerous because it enlarges the blast radius of any compromise in the update channel or vendor infrastructure and undermines the expectation of static reviewed code.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The script is designed to access and delete shared state files including credentials.json, showing that this skill package can interact with authentication material outside its stated functionality. Access to shared credential storage by an unrelated media-processing skill increases blast radius: a compromised or modified package could read, misuse, or destroy credentials affecting the whole Beatra environment.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
The _device_token function reads an access token from credentials.json so it can be used in an Authorization header for remote revocation. Direct token access by a photo-restyling skill is dangerous because any code execution in the package can repurpose that token for unauthorized API actions or exfiltration, extending impact beyond this single skill.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool scope even though its instructions rely on powerful capabilities including shell, network, file read/write, and environment access. That absence of least-privilege boundaries increases the chance that the host agent can invoke broader capabilities than required for simple photo restyling, especially given the skill also performs registration, updates, and remote operations.
The skill includes self-updating package behavior unrelated to its core photo-restyling function. Even with integrity claims, embedded self-update logic introduces a software supply-chain and persistence mechanism into a content-processing skill, increasing risk if the update channel, package signing, or client is compromised.
The skill allows automatic package updates without separate user confirmation. Silent updates reduce user control and can turn the skill into a moving trust target, where future code with different behavior is introduced after the original review or consent.
The changelog text says to lead with the Simplified Chinese display name, which is a natural-language locale preference embedded in the manifest. This appears to impose a language/locale ordering choice without indicating user choice or a region-specific justification, matching the policy-violation category.
The document states that the client silently checks for updates by default and automatically installs a newer release without separate confirmation. Even though the text describes integrity checks and rollback protections, silently modifying installed code expands the trust boundary and removes explicit user consent, which is dangerous in an agent context because future package behavior can change before ordinary commands run.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
detect completion yourself — never ask the user to confirm in chat that
they approved.
Approval legitimately takes minutes when sign-in or account creation is
The code fingerprints the host agent platform from environment variables and captures the device hostname, then persists and later transmits that metadata. For a photo restyling skill, this data is not obviously necessary and increases privacy and tracking risk by exposing details about the user's environment beyond the core function.
The skill writes a persistent local inventory of installed skills and install paths, which creates unnecessary local surveillance data unrelated to transforming photos. This expands the sensitivity of local state and could reveal user tooling, filesystem layout, and usage patterns if accessed by other software or through later compromise.
maybe_auto_update() can silently check for, download, and apply code updates during normal command execution, without user-facing notice at the moment of modification. Even with checksum validation, silent code replacement changes the local trust boundary and can convert a later server/CDN compromise into immediate code execution on user systems.
No suspicious patterns detected.