Security audit
Security checks across malware telemetry and agentic risk
The skill can perform its ecommerce image workflow, but it asks for broad Beatra account powers and silently registers/updates itself, so it should go to Review before installation.
Install only if you are comfortable granting Beatra a broad shared device authorization, uploading product assets to Beatra, allowing package registration telemetry, and accepting silent package updates by default. Consider disabling automatic updates with the documented update command and reviewing the Beatra account authorization before using it for sensitive product or business content.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
_atomic_json(
credential_path,
{#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",VirusTotal findings are pending for this skill version.
No suspicious patterns detected.