Security audit
Security checks for vulnerabilities and agentic risk
This booking voice skill is not clearly malicious, but it asks for and ships far broader Beatra account, billing, update, and tool-calling authority than its voice-clip purpose requires.
Install only if you are comfortable giving this package a shared Beatra device token with broad media-generation, wallet, task, upload, telemetry, uninstall, and auto-update authority. Consider disabling automatic updates immediately and using a dedicated Beatra account or environment if you only need booking-confirmation speech clips.
The skill's stated function does not suggest uninstall capability, deletion of local state, inspection of installed inventory, network revocation calls, or broader connection lifecycle management. Embedding these admin-style behaviors in a content-production skill expands the blast radius of compromise or misuse and makes accidental destructive actions more plausible.
The skill's stated function does not suggest uninstall capability, deletion of local state, inspection of installed inventory, network revocation calls, or broader connection lifecycle management. Embedding these admin-style behaviors in a content-production skill expands the blast radius of compromise or misuse and makes accidental destructive actions more plausible.
The skill's stated function does not suggest uninstall capability, deletion of local state, inspection of installed inventory, network revocation calls, or broader connection lifecycle management. Embedding these admin-style behaviors in a content-production skill expands the blast radius of compromise or misuse and makes accidental destructive actions more plausible.
Automatic download and installation is unjustified for a booking voice-pack skill and materially increases risk because reviewed content can later fetch and replace local package-owned files. This turns a narrowly scoped content workflow into an extensible code-delivery path, which is especially dangerous when paired with shell, network, and file capabilities.
This file introduces billing, task submission, authentication recovery, and transport retry logic that is materially unrelated to the stated purpose of generating booking confirmation voice clips. Even though it is framed as documentation, expanding a narrow booking skill to handle account-level billing and authorization flows increases the attack surface and creates a path for unintended financial or account-management actions if an agent follows these instructions in the wrong context.
The skill contains instructions for authentication repair, scope escalation, reauthorization, and balance-handling behavior that are unjustified for a booking-confirmation audio skill. In an agentic environment, such guidance can steer the agent into reconnecting accounts, handling authorization state, or facilitating billable retries beyond the user's intended task, which raises the risk of unauthorized account changes or charges.
The documented behavior adds an installation-registration/reporting call that is unrelated to the skill's stated function of generating booking confirmation voice clips. Even if described as 'best-effort' and non-blocking, it collects and transmits installation, network-route, and runtime metadata, creating an unnecessary data-exfiltration path and expanding the trust boundary beyond what users would reasonably expect from this skill.
The file explicitly states that the client records package/version, platform, stable installation reference, distribution channel, locale, network route, install source, OS/version, architecture, Python version, interface language, and time-zone offset. For a voice-clip booking skill, this telemetry is disproportionate to the stated purpose and can be used for device fingerprinting, user/environment profiling, and tracking installations across networks and time.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The skill requests a very broad OAuth scope set including artifacts, images, videos, music, speech, voices, wallet spending, and task control, which far exceeds the stated purpose of generating booking confirmation voice clips. Over-privileged authorization increases blast radius: if the skill, host agent, or stored credential is abused, an attacker could access unrelated resources and perform actions the user would not reasonably expect from this package.
Including wallet spending and unrelated media-generation scopes is especially dangerous in the context of a simple booking confirmation voice pack, because those permissions enable monetizable or destructive actions outside the advertised feature set. This mismatch between declared purpose and requested capability is a strong least-privilege failure and materially raises the risk of financial abuse, unauthorized content generation, and lateral misuse of the user's account.
The client exposes broad networked MCP access, package self-update, installation registration, and arbitrary upload features that are far beyond a booking-confirmation voice skill's stated purpose. This creates a large capability gap between user expectations and actual behavior, enabling remote command surface expansion and data movement if the backend, package channel, or skill distribution is abused.
The CLI supports generic tools/list and tools/call operations, allowing this package to invoke arbitrary MCP tools rather than only booking-confirmation functions. In the context of a narrowly described voice-pack skill, that mismatch materially increases abuse potential because the package becomes a general-purpose broker to remote capabilities.
The exposed self-update command allows the package to modify its own installed code, which is a dangerous capability for a skill whose declared role is generating booking-confirmation voice clips. In this context, self-modification increases persistence and supply-chain risk, and a compromised update path could turn the skill into a vehicle for remote code replacement.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The uninstall script is explicitly designed to manage shared device authorization and shared state under ~/.beatra, which is far outside the advertised purpose of generating booking confirmation voice clips. Even though the code includes safeguards to avoid revoking credentials while other skills remain, it still handles cross-skill connection state and can remove credentials, inventory, and host metadata if this package is believed to be the last installed skill.
Listing credentials.json among files the skill may delete indicates the package is aware of and authorized to manipulate shared credential material. While mere filename presence is not theft by itself, in this context it confirms the skill can affect authentication state stored for all skills, increasing the blast radius if the package is tampered with or misused.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
This section constructs a revocation URL from local route state and sends a bearer-token-authenticated POST to revoke device authorization, which gives the skill package influence over account/device access state unrelated to booking-confirmation audio generation. In the context of an agent skill, that capability is dangerous because compromised or modified skill code could revoke access, disrupt other installed skills, or manipulate shared installation state.
The _device_token function reads access_token from ~/.beatra/credentials.json so the skill can use it in an Authorization header for revocation. Direct access to bearer tokens by a skill is dangerous because any code execution in the skill context can repurpose that token for unauthorized API calls, account disruption, or cross-skill impact.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):