Security audit
Security checks for vulnerabilities and agentic risk
Beatra appears to be a coherent media and public-social-data integration, but it needs Review because it uses a broad persistent Beatra token and silently self-updates local executable files by default.
Install only if you are comfortable giving Beatra a persistent device connection that can run paid media/social-data tasks through your account and upload selected local media. Review the automatic-update behavior in particular; disable it with the documented update command if you want updates to require manual action. Use voice cloning only with proper consent and revoke the device from the Beatra Console if you stop using it.
The skill also covers uninstall, revocation, inspection of local inventory under ~/.beatra, deletion of local state, and network revocation behavior, none of which are apparent from the advertised media-generation role. This creates a dangerous expectation gap: users may invoke a content tool without realizing it can inspect or modify local credential and installation state.
The skill also covers uninstall, revocation, inspection of local inventory under ~/.beatra, deletion of local state, and network revocation behavior, none of which are apparent from the advertised media-generation role. This creates a dangerous expectation gap: users may invoke a content tool without realizing it can inspect or modify local credential and installation state.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The exposed self-update capability allows the package to modify its own installed code, which is a powerful primitive even if intended for legitimate updates. In an agent skill context, self-modification increases supply-chain risk and makes post-install behavior mutable in ways users may not expect from a media tool.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill clearly expects broad execution capabilities including shell, network, file read/write, and environment access, yet it declares no explicit tool scope. That mismatch weakens least-privilege controls and makes it easier for the skill to obtain more host power than users or reviewers would reasonably expect, especially given its ability to authorize, upload, update, and manage local state.
The skill is designed to reuse source media, returned files, public social findings, connection state, and task history across runs, implying persistence of artifacts and credentials beyond a single interaction. Persistent state is not inherently malicious, but it increases exposure if prior user data, generated assets, or authorization tokens are later accessed, reused, or mishandled.
---
name: "beatra"
description: "Create AI images, videos, music, and voice, look up public social data, edit visual results, and keep generated assets easy to find and manage. Beatra Universal turns text into images, images and references into video, ideas into songs or instrumentals, and scripts into narration, while also supporting custom voice creation and public social media data lookup across YouTube, TikTok, Instagram, and X. Use it as an AI media generator and AI creative suite for text-to-image, image-to-video, AI video editing, AI music generation, text-to-speech, multilingual voice-over, voice cloning, multimodal content creation, and YouTube or TikTok data for posts, comments, accounts, and trends. Reuse source media, returned files, and public social findings across formats, follow production progress, and view actual credit use for completed creative work."
---
# Beatra Universal
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Show the route's live-card duration, resolution, and aspect beside the estimate,
taking the shortest admitted duration and lowest admitted resolution unless the
user named a higher tier; audio-led and extend rules are unchanged. Planning,
comparison, or “make the clip” is not approval; approving this card is. Do not
ask the user to confirm they have enough credits — the connection reports the
balance itself — and do not create `client_request_id` or submit before they
approve.
The default prompt is extremely broad and can activate the skill for very common user intents like creating media or looking up social data. That increases the chance of over-invocation, where the agent routes requests to this third-party capability unnecessarily, potentially exposing user prompts or causing unintended external actions and costs.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
"icon": "https://beatra.ai/textures/icons/beatra-universal.png",
"localized": {
"en": {
"description": "Create AI images, videos, music, and voice, look up public social data, edit visual results, and keep generated assets easy to find and manage. Beatra Universal turns text into images, images and references into video, ideas into songs or instrumentals, and scripts into narration, while also supporting custom voice creation and public social media data lookup across YouTube, TikTok, Instagram, and X. Use it as an AI media generator and AI creative suite for text-to-image, image-to-video, AI video editing, AI music generation, text-to-speech, multilingual voice-over, voice cloning, multimodal content creation, and YouTube or TikTok data for posts, comments, accounts, and trends. Reuse source media, returned files, and public social findings across formats, follow production progress, and view actual credit use for completed creative work.",
"display_name": "Beatra Universal",
"summary": "Create AI images, videos, music, and voice, look up public social data, edit supported visual results, and keep returned files and credit use easy to track through one shared connection.",
"tags": [
This manifest is a JSON manifest file, so SQP-2 applies as a markdown/description-style warning check rather than a code-operation check. The English description and summary advertise looking up public social data across multiple platforms and reusing returned files and findings, but they do not disclose any privacy, compliance, or data-sensitivity considerations to users.
The Japanese localized description includes AI voice cloning and public social-data lookup, both of which can affect privacy, consent, or data handling expectations. No accompanying warning is provided in the localized user-facing text about responsible use, consent for voice cloning, or handling of collected public data.
The Chinese localized description prominently markets AI voice cloning and collection of public social data, but does not include any user-facing caution about consent, privacy, or appropriate use. Because these behaviors can affect user data and third-party rights, the omission is a meaningful missing-warning issue in the skill description.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"device_authorization_endpoint": "https://api.beatra.ai/oauth/device_authorization",
"name": "beatra",
"token_endpoint": "https://api.beatra.ai/oauth/token",
"transport": "streamable-http",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"device_authorization_endpoint": "https://api.beatra.ai/oauth/device_authorization",
"name": "beatra",
"token_endpoint": "https://api.beatra.ai/oauth/token",
"transport": "streamable-http",
The document states the client silently checks for and automatically installs updates by default before ordinary commands, without separate confirmation. Even with checksum and origin verification, silently modifying local executables/files creates a supply-chain and user-consent risk: a compromised update infrastructure, signing pipeline, or misconfiguration could alter the local installation without an explicit user decision at update time.
The file states that updates are fetched for the package's embedded channel and locale, which indicates locale-specific behavior is enforced automatically. Because no user choice, opt-in, or documented justification for the locale constraint is provided here, this may violate the language/locale policy.
No suspicious patterns detected.