Security audit
Security checks for vulnerabilities and agentic risk
This video skill appears to support the advertised generation workflow, but it also keeps broad Beatra account authority and can silently replace its local package files, so it needs Review before installation.
Install only if you trust Beatra to hold a broad shared device authorization for this machine and to deliver verified automatic updates. Review the requested account scope, the wallet-spend permission, the installation registration metadata, and whether you want to disable automatic updates after installation before using paid generation.
A skill advertised for video generation also documents uninstall, credential revocation, and deletion of local state under ~/.beatra. Combining destructive maintenance functions with a creative workflow increases the chance that an agent invokes filesystem- or account-affecting actions outside the user's expectation, especially when the description does not surface this power.
A skill advertised for video generation also documents uninstall, credential revocation, and deletion of local state under ~/.beatra. Combining destructive maintenance functions with a creative workflow increases the chance that an agent invokes filesystem- or account-affecting actions outside the user's expectation, especially when the description does not surface this power.
A skill advertised for video generation also documents uninstall, credential revocation, and deletion of local state under ~/.beatra. Combining destructive maintenance functions with a creative workflow increases the chance that an agent invokes filesystem- or account-affecting actions outside the user's expectation, especially when the description does not surface this power.
The file documents a non-essential installation registration and telemetry flow that is unrelated to the skill's declared purpose of generating transition videos. Even though it is framed as best-effort and excludes some obvious sensitive fields, it still collects persistent installation identifiers, network route, install source, locale, and runtime metadata, creating unnecessary tracking surface and privacy risk for users of a media-generation skill.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization helper requests a very broad OAuth scope set, including artifacts, images, videos, music, speech, voices, wallet spending, and task operations, even though the skill is described as a narrowly scoped first/last-frame video generator. This violates least privilege and would grant any holder of the saved bearer credential capabilities well beyond the skill's declared purpose, increasing blast radius if the token is misused or the skill is compromised.
Including wallet:spend plus voice/music/speech-related scopes for a two-images-to-video transition skill is especially dangerous because it authorizes financially and functionally unrelated actions. If the credential is reused by this or another local skill sharing the same state directory, an attacker or buggy component could spend funds or access unrelated generation features without any separate consent step.
The client contains a full self-update and installation-management subsystem far beyond the declared single-purpose first/last-frame video functionality. Even though it includes integrity checks, it can download and replace local package files, creating a powerful code-modification path that materially increases supply-chain and post-installation risk for a simple media skill.
The script exposes a generic MCP tool runner that can list tools and invoke arbitrary remote tool names with JSON from stdin, rather than restricting behavior to the advertised first/last-frame video workflow. That design breaks least privilege and allows the skill package to act as a broad proxy to backend capabilities beyond the user-expected feature set.
The skill explicitly supports self-update that can replace its own installed code and associated files. In the context of a simple first/last-frame video generator, self-modifying behavior is unusually powerful and dangerous because any compromise of the update channel or publisher trust chain can become arbitrary local code replacement.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope while its documented behavior relies on high-risk capabilities including shell, filesystem, network, and environment access. Without a least-privilege allowlist, an invoking agent may grant broader access than necessary, increasing the blast radius if the skill is misused or compromised.
The documentation includes package self-update mechanics that are outside the stated video-transition purpose, introducing software supply-chain and system modification behavior into an otherwise media-focused skill. Embedding updater behavior in the same skill expands trust requirements and makes compromise or misconfiguration more consequential.
Automatic software updates are not necessary to perform first/last-frame interpolation, yet the skill enables them as part of normal operation. Unrelated auto-update capability increases the attack surface and can alter local code over time, undermining predictability and trust in a skill that should be task-specific.
The skill states that newer releases install without separate confirmation, and the warning can be overlooked inside routine runtime text. Silent code replacement materially changes local behavior without a fresh trust decision, creating a supply-chain and user-consent risk that is especially dangerous in a skill already capable of shell, network, and file operations.
The changelog states that in mainland China the helper now connects through a mainland network, with an alternative international sign-in path only if needed. This imposes region-specific behavior in natural language without clearly framing it as an explicit user opt-in or user-selectable locale preference.
The document states that update checks are silent and enabled by default, and that higher versions are installed automatically without separate confirmation. Even with integrity and origin checks, automatic file replacement without an explicit opt-in or prominent warning reduces user control and can create supply-chain risk if the trusted update channel or signing process is ever compromised.
No suspicious patterns detected.