Security audit
Security checks for vulnerabilities and agentic risk
This comment-analysis skill needs review because connecting it grants account permissions beyond what its workflow requires.
Review the full Beatra permissions before connecting: they include unrelated media and voice capabilities, and lookup approval relies on the agent following instructions. Pasted comments need no paid lookup. Registration sends installation and runtime information; revoke the shared device authorization in Beatra Console when access is no longer wanted.
scripts/mcp_client.pyPaid execution lacks an enforced per-request approval gate
A direct invocation can spend the user's Beatra credits without the required approval for that lookup. Repeated valid calls can incur additional charges while funds remain available.
The reported media-generation and voice-management authorization scopes exceed what a comment-analysis workflow needs, creating an excessive-privilege exposure if those permissions are granted. Wallet spending is not inherently mismatched because the skill explicitly discloses paid lookups, but unrelated permissions could enable unauthorized charges or voice-resource changes if credentials or tool invocation are abused.
The supplied chunk implements connection teardown and uninstallation, not comment collection or analysis. Although uninstall tooling can legitimately accompany a skill, credential revocation and removal of shared cross-skill state are substantive administrative capabilities not represented in the declared description, rather than implementation details of comment analysis. The script includes conservative inventory checks, redirect rejection, and a dry-run option; those safeguards do not eliminate the description-behavior mismatch. This finding is limited to the supplied chunk and does not establish malicious behavior or whether other files implement the advertised workflow.
The reported unrestricted remote-tool invocation would leave the workflow's comment-operation whitelist as an instruction rather than an enforced security boundary, potentially enabling unrelated privileged operations. User-selected uploads are partially disclosed and are not inherently exfiltration, but broad file-upload capability and undisclosed installation telemetry increase the exposure beyond comment analysis; the implementation was not supplied to verify its consent and access controls.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
and keeps checking through brief network failures. One run waits up to
about 15 minutes; an approval page stays open for up to an hour;
5. atomically saves the returned Device Token to
`~/.beatra/credentials.json` without printing an HTTP response body;
6. validates the new credential with the same non-billable MCP request and
prints `Beatra is ready` only after it succeeds.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _existing_credential(state_dir: Path) -> Path | None:
path = state_dir / "credentials.json"
try:
path_stat = os.lstat(path)
if not stat.S_ISREG(path_stat.st_mode):
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
with _SIGNALS.deferred():
_atomic_json(
credential_path,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
the file ACL. Never copy the Device Token into conversation context, stdout,
stderr, a command argument, an environment variable, a log, a backup, a diff,
or another file. A completed authorization leaves the token only in
`~/.beatra/credentials.json`.
## Ensure Beatra is ready
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#: is empty — the script never recursively deletes a directory it does not
#: fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
# Updates and security
Since the October 2026 releases, Beatra Skill packages contain no self-updater.
Earlier releases could replace their own files from Beatra's CDN; that code has
been removed. Updates now come only from the store or tool you installed the
Skill from.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
These files are written under `~/.beatra/`. On POSIX that directory is mode
0700. Nothing is written inside the installed Skill directory.
- `credentials.json` (POSIX mode 0600), written by `scripts/authorize.py`: the device credential.
- `installation.json` (POSIX mode 0600), written by `scripts/authorize.py`: the stable installation reference.
- `host.json` (POSIX mode 0600), written by `scripts/authorize.py`: the agent environment, and a device name when one is known.
- `network.json` (POSIX mode 0600), written by `scripts/mcp_client.py`: this computer's network route.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
When `scripts/uninstall.py` decides this is the last Beatra skill on the
computer, it first asks Beatra to revoke the device credential when one is
stored. If Beatra refuses, it changes nothing so the run can be repeated.
Otherwise it unlinks exactly these names in `~/.beatra/`: `credentials.json`,
`installation.json`, `host.json`, `skills.json`, `registrations.json`,
`network.json`, `balance-holds.json`, `pending_authorization.json`, and
`.authorize.lock`. It also unlinks `state.json`, `registration.json`, and
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _credentials(state_dir: Path) -> tuple[str, str]:
state_dir = state_dir.expanduser()
path = state_dir / "credentials.json"
if not path.is_file():
# Not connected yet (or the file is gone): the caller may still find
# an approval waiting to be collected.
A skill advertised for public-comment analysis requests wallet spending, media generation, voice management, and task cancellation permissions that exceed its stated purpose. If granted and enforced as named, these permissions increase the consequences of token theft, agent misuse, or compromised skill code to include unauthorized charges and changes to unrelated resources; the script also rejects narrower credential scopes.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
get-by-URL on this list.
A category search takes `keyword` on the platform's search operation. After the user
picks one result, use that result's own identifiers — do not ask the user to go copy
an ID from the app.
### Reply threads
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Reply threads
Confirm each reply lookup on its own. Take every identifier from the comments payload
already in hand, plus the post identifier already used. Never ask the user for
`comment_id`, `item_id`, or `continuation_token`.
- **TikTok and Douyin** require `item_id` and `comment_id`. `item_id` is the same
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
The authorization explicitly covers image, video, music, speech, upload, model, and task tools, substantially exceeding the comment-analysis skill's stated needs. This violates least privilege: compromise of the shared token or misuse by an agent could enable unrelated operations and potentially incur charges or upload data. Browser approval provides consent to connect, but does not eliminate the risk of excessive permissions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
L03–L20 document recurring registration calls that report a stable installation reference, installation source, network route, and runtime facts. L23–L24 identify distribution and network analytics as the purpose of this reporting, which is separate from retrieving public comments or producing audience briefs and is not declared in the manifest.
These instructions explicitly cover reference-video generation, video editing, and billable input/output video usage. Together with the Beatra task polling, listing, and cancellation instructions elsewhere in the file, they introduce a generation-task workflow that is not justified by the manifest's public-comment collection and VOC brief purpose. The file does not itself demonstrate that generation or charges are initiated.