Security audit
Security checks for vulnerabilities and agentic risk
The skill’s video workflow is coherent, but it deserves Review because it stores a broad Beatra device token and silently self-updates local package files by default.
Review this skill carefully before installing if you are not comfortable with a shared Beatra credential, paid wallet-capable access, and default silent package updates. If installed, consider disabling auto-updates with the documented update command and revoke the Beatra device from the console when you no longer use it.
The inclusion of 'tasks:cancel' is not clearly supported by the skill description and grants the ability to interfere with task execution beyond simple video continuation. While less severe than spending or credential misuse, it could disrupt user workflows or cancel unrelated jobs if the token is reused broadly.
The references to uninstall flows, credential revocation, local state deletion, and package management go well beyond the expected scope of a video continuation skill. Even if some of these actions occur only in adjacent workflows, embedding them within the skill package increases the chance that a host agent or user authorizes privileged lifecycle operations under the guise of simple media generation.
The references to uninstall flows, credential revocation, local state deletion, and package management go well beyond the expected scope of a video continuation skill. Even if some of these actions occur only in adjacent workflows, embedding them within the skill package increases the chance that a host agent or user authorizes privileged lifecycle operations under the guise of simple media generation.
The references to uninstall flows, credential revocation, local state deletion, and package management go well beyond the expected scope of a video continuation skill. Even if some of these actions occur only in adjacent workflows, embedding them within the skill package increases the chance that a host agent or user authorizes privileged lifecycle operations under the guise of simple media generation.
The file is materially mismatched with the declared skill purpose: instead of describing video continuation behavior, it documents a package updater that modifies installed files. This mismatch is dangerous because unrelated operational capabilities in a narrowly scoped skill can conceal unexpected privileged behavior and reduce a user's ability to give informed consent.
The documentation describes a client that silently checks for and automatically installs updates before ordinary commands, which is unrelated to the stated purpose of an AI video continuation skill. Even if the update path includes integrity checks, silent self-modifying behavior expands the trust boundary, can surprise users, and creates a supply-chain execution path that could alter local code without explicit consent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The skill requests a very broad OAuth scope set that far exceeds the advertised purpose of video continuation, including artifacts, images, music, speech, voices, wallet spending, and task control. Over-scoped tokens violate least privilege and materially increase blast radius if the token is misused, leaked, or the skill behaves unexpectedly.
The inclusion of 'tasks:cancel' is not clearly supported by the skill description and grants the ability to interfere with task execution beyond simple video continuation. While less severe than spending or credential misuse, it could disrupt user workflows or cancel unrelated jobs if the token is reused broadly.
The package can self-modify by downloading and replacing its own files at runtime. Even with checksum and manifest checks, self-update creates a high-impact supply-chain risk: compromise of the discovery, signing/checksum publication, or update infrastructure would let an attacker change local executable code under the guise of a creative skill.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill exposes broad operational capabilities—shell execution, filesystem access, network access, and environment access—without declaring any explicit tool scope or permissions boundary. In a skill that can upload files, call remote services, and invoke a bundled Python client, the lack of a clear allowlist increases the risk of over-privileged execution, misuse by the host agent, and accidental access to sensitive local resources.
The skill states that newer releases install automatically without separate confirmation, while also granting the updater authority to replace package-owned files. Even with integrity checks, silent self-update materially changes the trusted code after installation and can expand capabilities or introduce regressions without timely, informed user consent.
The changelog states that users in mainland China are routed through a different network and may be sent to an alternate sign-in flow, but this behavior is not presented as an explicit, locale-aware user choice in the manifest. Silent or implicit region-based routing can affect privacy, user consent, and trust, especially when authentication endpoints differ by geography.
The markdown says update checks are silent and enabled by default, and that higher versions are installed automatically without separate confirmation. Lack of upfront warning about automatic system-modifying behavior undermines informed consent and increases the risk that users run ordinary commands while unknowingly permitting local code replacement.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
No suspicious patterns detected.