Security audit
Security checks for vulnerabilities and agentic risk
This song-making skill requests broader account access than it needs and has a removal flaw that could disconnect other Beatra skills.
Review the broad account permissions before connecting; music-only access would reduce exposure. Approved lyrics go to Beatra, and installation analytics are sent automatically. Avoid confidential inputs and approve each paid song or batch. Removal may disrupt other Beatra skills; access can also be revoked in the Beatra Console.
The reported image, video, and voice-management authorization exceeds the exam-song workflow and unnecessarily expands what compromised credentials or an induced tool call could do. Wallet spending is not inherently a mismatch because the skill explicitly describes paid generation and approval gates, but those gates do not justify unrelated authorization scopes.
The supplied chunk implements connection teardown and credential lifecycle management, not mnemonic-song creation. Although an uninstall script can be legitimate package support, its management of shared credentials, remote authorization, and cross-skill state is a substantive capability not represented in the declared purpose. The code conservatively preserves the connection when other skills remain or inventory status is uncertain; this limits its effects but does not resolve the description mismatch.
The reported automatic transmission of an installation identifier and environment metadata creates a privacy exposure not explained in the supplied SKILL.md. Generic upload and tool-call support further broaden the attack surface, although their existence alone does not prove arbitrary-file exfiltration; the referenced implementation and authorization checks were not supplied.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
and keeps checking through brief network failures. One run waits up to
about 15 minutes; an approval page stays open for up to an hour;
5. atomically saves the returned Device Token to
`~/.beatra/credentials.json` without printing an HTTP response body;
6. validates the new credential with the same non-billable MCP request and
prints `Beatra is ready` only after it succeeds.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
These files are written under `~/.beatra/`. On POSIX that directory is mode
0700. Nothing is written inside the installed Skill directory.
- `credentials.json` (POSIX mode 0600), written by `scripts/authorize.py`: the device credential.
- `installation.json` (POSIX mode 0600), written by `scripts/authorize.py`: the stable installation reference.
- `host.json` (POSIX mode 0600), written by `scripts/authorize.py`: the agent environment, and a device name when one is known.
- `network.json` (POSIX mode 0600), written by `scripts/mcp_client.py`: this computer's network route.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
When `scripts/uninstall.py` decides this is the last Beatra skill on the
computer, it first asks Beatra to revoke the device credential when one is
stored. If Beatra refuses, it changes nothing so the run can be repeated.
Otherwise it unlinks exactly these names in `~/.beatra/`: `credentials.json`,
`installation.json`, `host.json`, `skills.json`, `registrations.json`,
`network.json`, `balance-holds.json`, `pending_authorization.json`, and
`.authorize.lock`. It also unlinks `state.json`, `registration.json`, and
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _credentials(state_dir: Path) -> tuple[str, str]:
state_dir = state_dir.expanduser()
path = state_dir / "credentials.json"
if not path.is_file():
# Not connected yet (or the file is gone): the caller may still find
# an approval waiting to be collected.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#: is empty — the script never recursively deletes a directory it does not
#: fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
the file ACL. Never copy the Device Token into conversation context, stdout,
stderr, a command argument, an environment variable, a log, a backup, a diff,
or another file. A completed authorization leaves the token only in
`~/.beatra/credentials.json`.
## Ensure Beatra is ready
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
# Updates and security
Since the October 2026 releases, Beatra Skill packages contain no self-updater.
Earlier releases could replace their own files from Beatra's CDN; that code has
been removed. Updates now come only from the store or tool you installed the
Skill from.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _existing_credential(state_dir: Path) -> Path | None:
path = state_dir / "credentials.json"
try:
path_stat = os.lstat(path)
if not stat.S_ISREG(path_stat.st_mode):
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
with _SIGNALS.deferred():
_atomic_json(
credential_path,
The inventory loader silently drops non-dictionary entries instead of treating them as uncertainty. If an entry representing another installed skill is malformed, the survivor list can become empty, allowing this uninstall to revoke the shared credential and remove shared state despite other skills remaining installed. The shared connection increases the impact from a single uninstall to disruption of multiple skills.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
The reference explicitly states that one authorization covers image, video, music, speech, upload, model, and task tools, exceeding the apparent needs of a mnemonic-song skill. This violates least privilege and could increase the consequences of credential theft or agent misuse, although this file does not establish the exact permissions or demonstrate unauthorized use.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The document describes automatic, recurring transmission of a stable installation identifier, installation provenance, network-route information, and runtime characteristics without specifying explicit consent or an opt-out. This creates a privacy risk through persistent installation tracking and environment profiling unrelated to producing mnemonic songs. The disclosed field restrictions and non-blocking behavior limit the apparent exposure, but the document alone cannot verify those restrictions or establish malicious intent.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The workflow instructs the agent to submit approved mnemonic lyrics derived from teacher-supplied facts to Beatra using the Suno model. Although it requires approval before a billable generation, it does not disclose that the supplied content will be transmitted to an external service; cost approval is not a privacy warning.
The authorization scope includes image and video generation and voice-management permissions beyond the stated mnemonic-song functionality. Requiring these permissions, and rejecting credentials with a narrower scope, unnecessarily expands what a compromised credential or skill can do; the shared credential increases the exposure across installed Beatra skills.