Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a real Beatra video-generation helper, but it uses broad shared account authorization and silent self-updates that can change local package files.
Install only if you are comfortable giving Beatra a broad shared device authorization and allowing this package to update its own local files automatically. Before using it, consider running `python3 scripts/mcp_client.py update --auto off`, and review the Beatra account/credit implications because video generation can spend credits.
The skill references uninstall/disconnect behavior that can read and delete local state, inspect installed-skill inventory, revoke authorization, and affect shared connection state for other skills, despite being framed as a drama-shot generator. In context, this is especially risky because users invoking a creative tool would not reasonably expect destructive account or local-state operations.
The skill references uninstall/disconnect behavior that can read and delete local state, inspect installed-skill inventory, revoke authorization, and affect shared connection state for other skills, despite being framed as a drama-shot generator. In context, this is especially risky because users invoking a creative tool would not reasonably expect destructive account or local-state operations.
The skill references uninstall/disconnect behavior that can read and delete local state, inspect installed-skill inventory, revoke authorization, and affect shared connection state for other skills, despite being framed as a drama-shot generator. In context, this is especially risky because users invoking a creative tool would not reasonably expect destructive account or local-state operations.
Silent automatic installation before ordinary commands is dangerous because it allows code and file replacement on the user's system without per-action confirmation. In the context of a creative media skill, this capability is unjustified and increases the risk of supply-chain compromise, unexpected code execution, or persistence if the update channel is ever abused or misconfigured.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The requested OAuth scope is far broader than the skill's stated purpose of generating a single drama shot. In addition to image/video generation, it asks for artifacts read/write, tasks read/cancel, voices read/write, speech, music, and wallet spending, so a compromised or misused skill would receive capabilities unrelated to its advertised function. The mismatch between manifest purpose and granted permissions increases the blast radius substantially.
music:generate is not supported by the stated single-shot drama generation use case. Extra creative-generation permissions enlarge the attack surface and permit operations beyond user expectations if the token is later reused or compromised.
The client implements broad network-routing, registration, update, and installation-management behavior far beyond a micro-drama generation helper. Expanding a creative skill into a privileged package manager and telemetry client increases attack surface substantially and creates unexpected trust and persistence capabilities that users would not reasonably expect from the advertised function.
The client can download manifests and archives from remote infrastructure and replace files in its own installation, including the client script itself. Even with checksum and path validation, a self-updating skill materially increases supply-chain and persistence risk because compromise of the update channel or signing/discovery process yields arbitrary code replacement on the host.
Exposing self-update as a normal command makes remote code replacement an explicit feature of the skill. In the context of a drama-shot generator, this is especially risky because the capability is unrelated to the advertised purpose and gives the package a persistence and mutation mechanism that could be abused if the upstream service or distribution channel is compromised.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool/permission scope even though it instructs use of shell, file access, network access, and likely environment/credential handling through the bundled client. Without a least-privilege declaration, a host may grant broader capabilities than users expect, increasing the blast radius if the skill or updater is compromised.
The file documents a built-in self-update mechanism that is unrelated to the stated purpose of a shot-generation skill. Even though it claims verification and rollback protections, bundling silent updater behavior into a media-generation tool expands the trust boundary and creates a software supply-chain execution path that could modify the local installation outside the user's primary intent.
The documentation states that update checks and automatic installation are enabled by default and do not interrupt user work, which means local software can be changed without a clear foreground warning at the point of use. That is a security-relevant transparency failure because users may invoke a generation feature without realizing it can alter their installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The documentation describes an automatic installation-registration telemetry call that is unrelated to the skill’s stated purpose of generating cinematic drama shots. Even if limited in scope and described as non-blocking, it collects host, network-route, distribution, locale, and installation-source metadata, creating unnecessary tracking and privacy exposure for users of a creative-media skill.
No suspicious patterns detected.