Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its Douyin clip-making purpose, but it also uses a broad shared Beatra credential and silent self-updates, so it needs review before installation.
Install only if you are comfortable authorizing Beatra with a shared local Device Token, using credits for approved paid operations, allowing limited installation telemetry, and accepting silent package updates by default. Consider disabling automatic updates with the documented update command and use the bundled uninstall workflow if you later remove it.
The references and execution model indicate the package can also uninstall itself, inspect local installation state, revoke credentials, and delete local state under ~/.beatra, none of which are apparent from the skill description. Administrative deletion/revocation functionality inside a user-facing content skill is risky because it broadens local impact if the package is misused or compromised.
The references and execution model indicate the package can also uninstall itself, inspect local installation state, revoke credentials, and delete local state under ~/.beatra, none of which are apparent from the skill description. Administrative deletion/revocation functionality inside a user-facing content skill is risky because it broadens local impact if the package is misused or compromised.
The references and execution model indicate the package can also uninstall itself, inspect local installation state, revoke credentials, and delete local state under ~/.beatra, none of which are apparent from the skill description. Administrative deletion/revocation functionality inside a user-facing content skill is risky because it broadens local impact if the package is misused or compromised.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
The document instructs the skill to rely on a shared full-scope device token stored in the user's home directory, which gives this package access to an existing high-privilege credential. Even though it says not to print or move the token, normalizing use of a reusable full-scope credential across packages increases the blast radius of any compromised skill or tool in the package and creates a clear credential-access path.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The file implements a full device-authorization and credential-management flow with broad scopes, which is materially unrelated to the advertised Douyin comment-to-demo-clip functionality. That mismatch is dangerous because it grants persistent account access, wallet spend capability, and artifact/task privileges under the guise of a media-generation skill, increasing the risk of over-privileged access and deceptive installation behavior.
The file implements a broad networked control client with credential handling, remote tool invocation, telemetry/registration, uploads, and self-update behavior that substantially exceeds the declared 'Douyin comment demo clip' purpose. This capability mismatch is dangerous because it hides a general remote-management substrate inside a media skill, increasing supply-chain and user-trust risk and making unexpected data access or code changes more likely.
The package can download remote manifests and archives, validate them, and then overwrite files in its own installation directory. Even with integrity checks, self-modifying update logic inside a content-creation skill expands the blast radius of a compromise of the update channel or signing pipeline and is not justified by the manifest's narrow business purpose.
The file exposes a self-update command and related code paths that can replace installed package files, meaning the skill is capable of self-modification. In a narrowly scoped Douyin clip-generation skill, that is especially risky because it embeds software lifecycle control into a tool users would not expect to alter its own executable code.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope even though it instructs use of shell, filesystem, network, and environment-capable operations via a bundled client. That overbroad implicit capability increases attack surface and makes it harder for a host to sandbox the skill or prevent unexpected local/remote actions.
The skill advertises silent automatic updates that download and replace package-owned files without separate confirmation. Even if signed and verified, self-updating code materially changes the trusted codebase after installation and creates a supply-chain risk path unrelated to the core clip-generation task.
The skill can automatically install updates without separate confirmation, but that system-modifying behavior is not prominently disclosed in the skill's primary description. Users may invoke what appears to be a content-production skill without realizing it can alter local package files, which weakens informed consent and trust.
The manifest changelog explicitly states the helper routes through a mainland China network by default and only mentions an international approval-page alternative if another sign-in method is needed. This creates a covert routing/region-selection behavior without explicit user opt-in in the manifest, which can affect privacy, compliance, and user expectations about where authentication traffic is sent.
The document describes a client that silently checks for and automatically installs updates by default before normal commands, without explicit per-update user confirmation or a prominent warning about modifying local files. Even though the text claims strong integrity controls, silent self-updating expands the attack surface and creates risk from supply-chain compromise, misconfiguration, or unexpected file replacement behavior on user systems.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The documentation describes a built-in telemetry/registration call that reports installation, network route, install source, and runtime metadata unrelated to the skill's stated purpose of generating Douyin comment demo clips. Even if framed as non-billable and best-effort, this is still undisclosed or weakly justified data exfiltration behavior that expands the skill's effective privileges and creates privacy and tracking risk.