Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Beatra AI video skill, but it needs Review because it uses a broad persistent account token and silently self-updates its installed package by default.
Install only if you trust Beatra with uploaded media, account credits, and a persistent shared device token. Review the automatic-update default and disable it with the documented update command if you require store-mediated updates only; also consider whether the broad Beatra scope and installation registration telemetry fit your privacy and account-risk expectations.
The skill references uninstall/disconnect flows, inspection of shared local state under ~/.beatra, credential/config deletion, token revocation, and machine-readable uninstall decisions, none of which are disclosed by the core video-editing description. These capabilities create a risk of unexpected local file access and destructive state changes under the guise of a media tool.
The skill references uninstall/disconnect flows, inspection of shared local state under ~/.beatra, credential/config deletion, token revocation, and machine-readable uninstall decisions, none of which are disclosed by the core video-editing description. These capabilities create a risk of unexpected local file access and destructive state changes under the guise of a media tool.
The skill references uninstall/disconnect flows, inspection of shared local state under ~/.beatra, credential/config deletion, token revocation, and machine-readable uninstall decisions, none of which are disclosed by the core video-editing description. These capabilities create a risk of unexpected local file access and destructive state changes under the guise of a media tool.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The requested OAuth scope is far broader than needed for an AI video studio helper: it includes wallet spending plus image, music, speech, voice write, artifact read/write, and task cancel privileges. If the credential is compromised or the skill/runtime is abused, an attacker could generate unrelated content, access artifacts, cancel tasks, or spend funds well beyond the user's expected consent for video creation.
The exposed update command advertises and enables self-modification of the installed package. In an agent skill, self-modification materially changes the trust model because the tool can replace its own executable code outside the host's normal installation/update controls, turning backend or supply-chain compromise into local code execution.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill invokes shell commands, reads local files, uploads media, performs network calls, and supports self-update behavior, yet it declares no explicit tool/permission scope. That leaves the host with no least-privilege boundary and makes it easier for the skill to access broader capabilities than users would reasonably expect from a video-editing workflow.
The skill states that auto-updates use fixed package/channel/locale paths and that silent checks are enabled by default, with newer releases installing without separate confirmation. Enforcing locale-specific update behavior without clear opt-in or justification can alter code origin/behavior unexpectedly and reduces user control over what variant is installed.
The manifest explicitly says the skill works from supplied images, references, existing footage, and possibly audio, but it does not clearly warn users that this media will be transmitted to Beatra's remote service for processing. In a media-generation skill, users may provide sensitive or proprietary visual/audio assets, so omission of a clear disclosure creates a real privacy and data-handling risk rather than a purely informational issue.
The document describes a client that silently checks for updates and automatically installs newer releases without separate confirmation, which creates a software supply chain and user-consent risk even if integrity checks are present. Silent replacement of installed files can materially change behavior, introduce breaking changes, or propagate a compromised upstream release before the user is aware.
The document says updates come from a fixed discovery address and CDN path for the package's embedded channel and locale, which implies locale is predetermined by the package rather than selected by the user. This can violate language or locale policy when no user choice, opt-in, or clear justification is provided.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The documentation describes a non-essential installation registration call that collects package, platform, network route, install source, locale, and coarse runtime facts unrelated to the core video-generation purpose. Even if framed as best-effort and non-billable, this is telemetry and environment fingerprinting that expands data collection and creates privacy and tracking risk without clear user opt-in or necessity for the advertised function.
The skill documents collection of multiple stable and semi-stable attributes—installation reference, network route, install source, OS/version, architecture, Python version, interface language, and time-zone offset—that can be combined into a meaningful environment fingerprint. In the context of a video-creation skill, this collection is disproportionate to user expectations and increases the risk of cross-install tracking, profiling, and privacy harm if logged, correlated, or breached.
The documentation states distribution channel and locale are fixed at build time and recorded, but does not indicate any user awareness, control, or consent. While lower severity than the broader telemetry issues, collecting and transmitting these attributes without opt-in contributes to silent profiling and undermines transparency expectations for a media-generation skill.
No suspicious patterns detected.