Security audit
Security checks for vulnerabilities and agentic risk
This media-generation skill is mostly coherent and disclosed, but it can silently replace its own installed package files by default, which is high-impact enough to require review before installation.
Install only if you are comfortable with Beatra receiving selected media uploads and with the package managing a shared ~/.beatra device credential. Consider disabling silent updates immediately with `python3 scripts/mcp_client.py update --auto off` and use manual update checks instead.
The skill includes uninstall/cleanup and shared authentication lifecycle handling under ~/.beatra, including credential and inventory file access and network revocation flows, despite presenting itself primarily as a creative media tool. This is risky because users may not expect a content-generation skill to modify shared local auth state or affect other installed integrations.
The skill includes uninstall/cleanup and shared authentication lifecycle handling under ~/.beatra, including credential and inventory file access and network revocation flows, despite presenting itself primarily as a creative media tool. This is risky because users may not expect a content-generation skill to modify shared local auth state or affect other installed integrations.
The skill includes uninstall/cleanup and shared authentication lifecycle handling under ~/.beatra, including credential and inventory file access and network revocation flows, despite presenting itself primarily as a creative media tool. This is risky because users may not expect a content-generation skill to modify shared local auth state or affect other installed integrations.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
This section implements package self-update, including downloading manifests and archives and replacing files in the installed package. A media-generation skill does not need the ability to rewrite its own code, so this capability is unusually powerful for the context and would permit remote code changes on the user's machine if the update channel were abused or compromised.
The automatic update path silently performs network fetches and overwrites package files during normal execution without requiring user awareness at the moment of change. In a local agent skill, silent code replacement significantly increases supply-chain risk because the behavior alters trusted executable code outside the user's immediate control.
Exposing a self-update command in the client gives the skill an explicit self-modification capability, allowing it to alter its own installed code on disk. In the context of a media-generation skill, this is disproportionate privilege and materially increases the blast radius of any server-side compromise, update-manifest abuse, or operator error.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill invokes shell commands, performs networked authorization, uploads local files, and manages local state, but it does not declare any explicit tool scope or allowed-tools boundary. That increases the blast radius because a host or reviewer cannot clearly constrain what the skill is permitted to do, especially given its ability to touch files, network, and credentials.
The skill is designed to reuse prompts, source media, voices, model choices, and asynchronous task context across a shared connection and persistent state. While useful for workflow continuity, this persistence can expose prior user data, uploaded media references, or sensitive creative inputs across sessions or tasks if isolation boundaries are weak.
Turn a media outcome into the smallest verified Beatra workflow, complete it
through the shared connection, and return only what the task actually produced.
Use the host's native text and visual understanding to analyze a brief or source
media. Use Beatra to create and manage images, video, music, speech, reusable
voices, uploads, model choices, and asynchronous task results.
Reuse the destination, prompt, source media, format, language, voice, model,
The skill allows automatic package updates and replacement of package-owned files without separate confirmation. Even with claimed verification, silent code changes introduce supply-chain risk and make the security posture non-static after review, which is especially sensitive for a skill with shell, network, file, and credential-handling capabilities.
The changelog states that the helper connects through Beatra's mainland network and may open an approval page on Beatra's international site, which implies external network communication and account-related redirection. The text does not include any caution or disclosure about data routing, regional differences, or opening external sign-in pages.
This manifest file describes capabilities including multilingual voice-over, custom voice creation, voice cloning, and keeping all created files in one place, which can affect user privacy and sensitive data handling. For markdown and manifest-style descriptions, users should be warned when behavior may impact personal data or system integrity, but no such warning appears in the visible description text.
The document describes a bundled client that silently checks for and installs newer releases before normal commands, which is functionality unrelated to the declared AI media generation purpose. Self-updating code materially changes the local installation and creates a supply-chain attack surface; even with verification claims, this behavior increases risk because the skill can alter itself outside the user’s immediate action path.
Silent automatic package replacement lets the client modify installed files without separate confirmation, which is a system-affecting capability not justified by the stated creative-media use case. If the update channel or verification chain is ever compromised, this mechanism becomes a reliable path for arbitrary code delivery and persistence.
The text states that updates are installed automatically without separate confirmation, but it does not present this as a strong warning about local file replacement and trust implications. Users may unknowingly run software that changes itself before handling their requested task, undermining informed consent and making abuse harder to detect.
The skill explicitly instructs uploading local input images to an authenticated external MCP service, but does not require informing the user that local files will be transmitted off-device for processing. In a media-generation skill, users may reasonably supply private photos, proprietary visuals, or sensitive documents as image inputs, so silent exfiltration to a third-party service creates a real privacy and data-handling risk.
No suspicious patterns detected.