Security audit
Security checks across malware telemetry and agentic risk
This cover-making skill is not clearly malicious, but it asks for broad Beatra account permissions and silently updates its own files by default, so it belongs in Review before installation.
Review this skill carefully before installing. It is designed to create paid Douyin covers through Beatra, but one approval grants broad Beatra capabilities and stores a shared bearer token in ~/.beatra. Disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if you do not want the package to replace its own files silently, and only use it where broad Beatra account access and installation telemetry are acceptable.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",VirusTotal findings are pending for this skill version.
No suspicious patterns detected.