Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Beatra voice-generation integration, but it needs Review because it stores a shared Beatra token and silently self-updates local package files by default.
Review before installing. This skill can upload voice samples, spend Beatra credits after approvals, store a shared Beatra device token, and silently update its own package files unless automatic updates are turned off with `python3 scripts/mcp_client.py update --auto off`. Install only if you trust Beatra's service and update channel, and use voice cloning only with clear speaker consent.
The described purpose omits that the skill can inspect shared local inventory, revoke tokens, delete credential/config files, uninstall package state, and call remote revocation endpoints. Undisclosed destructive and account-affecting behavior is dangerous because it can alter the local environment or invalidate access without the user understanding those risks.
The described purpose omits that the skill can inspect shared local inventory, revoke tokens, delete credential/config files, uninstall package state, and call remote revocation endpoints. Undisclosed destructive and account-affecting behavior is dangerous because it can alter the local environment or invalidate access without the user understanding those risks.
The described purpose omits that the skill can inspect shared local inventory, revoke tokens, delete credential/config files, uninstall package state, and call remote revocation endpoints. Undisclosed destructive and account-affecting behavior is dangerous because it can alter the local environment or invalidate access without the user understanding those risks.
Automatic update and file replacement capability lets the skill modify local package files without a task-specific need tied to voice generation. This is dangerous because any compromise in discovery, manifest validation, channel control, or updater implementation could become arbitrary code or content replacement on the host.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
duration as a review target, not a guarantee. Preserve supplied claims,
pronunciations, names, ordering, and target-language text.
For cloning, the one non-negotiable first fact is consent. A clear statement
that it is the user's own voice is enough; otherwise obtain a clear statement
that the speaker authorized cloning. Do not turn that confirmation into
paperwork. Stop before upload while it is missing.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
duration as a review target, not a guarantee. Preserve supplied claims,
pronunciations, names, ordering, and target-language text.
For cloning, the one non-negotiable first fact is consent. A clear statement
that it is the user's own voice is enough; otherwise obtain a clear statement
that the speaker authorized cloning. Do not turn that confirmation into
paperwork. Stop before upload while it is missing.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The exposed update command enables the package to replace its own installed files, including scripts/mcp_client.py. In the context of an agent skill, self-modification is especially dangerous because it changes future behavior outside the user's immediate prompt flow; if the update channel or vendor infrastructure is ever compromised, the skill becomes a delivery mechanism for persistent malicious code.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill exposes significant capabilities (shell, network, file read/write, environment access) but does not declare any tool scope or permission boundaries. That makes the operational trust boundary unclear and can allow broader-than-necessary execution, especially since the skill performs installation, auth, upload, and update actions through a bundled client.
The self-updating package installation logic is not necessary for the core task of generating voice outputs and introduces supply-chain risk into an otherwise content-production skill. Even with verification claims, automatic code replacement changes the trusted codebase at runtime and broadens consequences if the update channel or verification logic is flawed.
The skill states that it silently checks for and installs updates automatically, but this is not prominently disclosed in the primary skill description. Silent modification of executable behavior undermines user expectations and informed consent, especially for a skill that also has shell, network, and file-write capabilities.
Binding automatic updates to a fixed channel and locale without user opt-in reduces transparency and user control over what code is fetched and applied. While less severe than unrestricted updates, it still creates unnecessary surprise and can expose users to region-specific behavior they did not knowingly select.
This manifest points to SKILL.md as the entry but provides no explicit invocation phrases, activation boundaries, or exclusion conditions in the manifest itself. For manifest files, missing specificity on when the skill should activate can lead to unintended invocation because the trigger scope is not clearly constrained.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
"icon": "https://beatra.ai/textures/icons/speech-tight.png",
"localized": {
"en": {
"description": "Use Beatra AI Voice Studio as an AI voice generator, text-to-speech workspace, and AI voiceover generator. Choose from the current voice library, turn scripts into ready-to-edit AI narration and voiceover, or create and reuse a custom brand voice through voice cloning. It supports short-video voiceover, script-to-voiceover, course narration, ordered audiobook narration, supplied multilingual text to speech, Cantonese text to speech, and recurring brand audio, with current price estimates, clear output planning, and delivery organized by chapter, language, and use case.",
"display_name": "Beatra AI Voice Studio",
"summary": "Choose or reuse a voice, turn scripts into ready-to-edit narration, plan ordered long-form or multilingual audio, and create a reusable custom voice.",
"tags": [
The manifest prominently advertises voice cloning and reusable brand voices without any user-facing warning that this is privacy-sensitive and may involve biometric voice data, consent requirements, and potential impersonation risk. In a voice-generation skill, that omission is materially important because users may submit third-party voices or assume cloning is routine without explicit safeguards.
The document states that the client silently checks for updates and installs newer releases automatically by default, without separate confirmation. Even with checksum, manifest, and path verification, this behavior modifies locally installed code without an explicit opt-in or prominent warning, which increases supply-chain and change-management risk if the update channel is ever compromised or if users are unaware their installation can self-modify.
No suspicious patterns detected.