Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because it requires unrelated account permissions and has an uninstall bug that can disconnect other Beatra skills.
Prefer a release with video-only authorization and corrected uninstall checks. If installing, understand that the shared approval also grants audio and voice permissions, images leave your computer, and recurring installation analytics are sent. Review paid requests and check other Beatra skills before uninstalling; access can be revoked through the Beatra Console.
scripts/mcp_client.pyBillable operations bypass the documented per-request confirmation gate
An Agent invocation that skips the documented confirmation step can submit paid video generation and consume the user's credits without approval for that request.
The reported voices:read, voices:write, music:generate, and speech:generate authorization exceeds the documented still-to-video workflow, creating an excessive-privilege risk if the client or its credentials are compromised. Wallet spending is expected and explicitly discussed in the skill, but unrelated voice and audio permissions are not justified by that context; the authorization implementation was not supplied for independent verification.
As reported, automatic transmission of a persistent installation identifier and detailed environment metadata creates a privacy exposure unrelated to generating assembly clips. The skill mentions registration and version checks, but does not clearly disclose this analytics payload or establish consent; transmission to an official service over HTTPS would not eliminate that concern.
The supplied chunk performs no image processing or video generation. Although uninstall support can legitimately accompany a skill, this script manages shared credentials, remote authorization, and local state beyond the declared clip-production purpose. Those consequential capabilities are not represented in the description or declared permissions. The code includes safeguards to preserve the connection when other skills remain or inventory status is uncertain; the mismatch does not itself establish malicious behavior.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
These files are written under `~/.beatra/`. On POSIX that directory is mode
0700. Nothing is written inside the installed Skill directory.
- `credentials.json` (POSIX mode 0600), written by `scripts/authorize.py`: the device credential.
- `installation.json` (POSIX mode 0600), written by `scripts/authorize.py`: the stable installation reference.
- `host.json` (POSIX mode 0600), written by `scripts/authorize.py`: the agent environment, and a device name when one is known.
- `network.json` (POSIX mode 0600), written by `scripts/mcp_client.py`: this computer's network route.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
When `scripts/uninstall.py` decides this is the last Beatra skill on the
computer, it first asks Beatra to revoke the device credential when one is
stored. If Beatra refuses, it changes nothing so the run can be repeated.
Otherwise it unlinks exactly these names in `~/.beatra/`: `credentials.json`,
`installation.json`, `host.json`, `skills.json`, `registrations.json`,
`network.json`, `balance-holds.json`, `pending_authorization.json`, and
`.authorize.lock`. It also unlinks `state.json`, `registration.json`, and
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _existing_credential(state_dir: Path) -> Path | None:
path = state_dir / "credentials.json"
try:
path_stat = os.lstat(path)
if not stat.S_ISREG(path_stat.st_mode):
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _credentials(state_dir: Path) -> tuple[str, str]:
state_dir = state_dir.expanduser()
path = state_dir / "credentials.json"
if not path.is_file():
# Not connected yet (or the file is gone): the caller may still find
# an approval waiting to be collected.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
and keeps checking through brief network failures. One run waits up to
about 15 minutes; an approval page stays open for up to an hour;
5. atomically saves the returned Device Token to
`~/.beatra/credentials.json` without printing an HTTP response body;
6. validates the new credential with the same non-billable MCP request and
prints `Beatra is ready` only after it succeeds.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
with _SIGNALS.deferred():
_atomic_json(
credential_path,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#: is empty — the script never recursively deletes a directory it does not
#: fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
the file ACL. Never copy the Device Token into conversation context, stdout,
stderr, a command argument, an environment variable, a log, a backup, a diff,
or another file. A completed authorization leaves the token only in
`~/.beatra/credentials.json`.
## Ensure Beatra is ready
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
# Updates and security
Since the October 2026 releases, Beatra Skill packages contain no self-updater.
Earlier releases could replace their own files from Beatra's CDN; that code has
been removed. Updates now come only from the store or tool you installed the
Skill from.
The inventory loader silently drops non-dictionary entries, treating malformed records as absent rather than evidence of an uncertain inventory. If another installed skill's record is malformed, uninstalling this package can incorrectly conclude that no other skills remain, revoke the shared device credential, and remove shared state, disrupting those skills.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The manifest describes converting authorized stills and seller-supplied facts into assembly videos, but this file states that the bundled client also calls beatra.installations.register on first use and periodically thereafter. The reported stable installation reference, installation source, network route, and runtime facts serve installation analytics rather than clip generation, extending behavior beyond the stated purpose.
The documented update command uses npx skills without pinning the CLI version, potentially fetching and executing a mutable npm release with the user's privileges. This is an optional maintenance command rather than an MCP server launch or automatic execution, which reduces exposure, but a compromised package release could still execute malicious code.
The second npx skills invocation has the same unpinned CLI execution risk as the first. It is another occurrence of the same supply-chain weakness, not a separate MCP server vulnerability; exploitation requires the command to be run and the resolved package to be malicious.
The workflow instructs the agent to upload the supplied stills through an upload grant and HTTP PUT, but does not instruct it to warn the user that their images will leave the local environment. The approval required later concerns billable animation and occurs after this data transfer.
The mandatory scope includes voices:read and voices:write, although the stated still-to-assembly-video workflow does not establish a need to manage voice resources. Both credential validation and token saving require the complete scope set, preventing reduced-privilege authorization and increasing the potential damage from credential compromise or misuse. The shared credential design may explain the broad permissions, but it does not establish that this skill needs them.