Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to perform the advertised Beatra video-generation workflow, but it also uses a broad shared Beatra account token and silent self-updates that warrant review before installation.
Install only if you are comfortable granting Beatra a shared device authorization with paid wallet-spending capability, uploading selected media to Beatra, sending limited installation telemetry, and allowing the package to auto-update itself. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, and approve paid clone, speech, or video stages only after reviewing the live cost cards.
The same skill also documents uninstall and local state-management behavior, including reading and modifying files under ~/.beatra, inspecting installed skills, and revoking tokens. Those system-management actions are unrelated to generating dividend talking clips and expand the skill into local software administration, which is more dangerous if triggered unexpectedly or abused.
The same skill also documents uninstall and local state-management behavior, including reading and modifying files under ~/.beatra, inspecting installed skills, and revoking tokens. Those system-management actions are unrelated to generating dividend talking clips and expand the skill into local software administration, which is more dangerous if triggered unexpectedly or abused.
The same skill also documents uninstall and local state-management behavior, including reading and modifying files under ~/.beatra, inspecting installed skills, and revoking tokens. Those system-management actions are unrelated to generating dividend talking clips and expand the skill into local software administration, which is more dangerous if triggered unexpectedly or abused.
Automatic download and installation is unjustified for the stated purpose and effectively grants the skill authority to replace package-owned files without separate confirmation. This creates a strong supply-chain risk: a compromised update channel, signing process, or package owner could convert a media skill into a vehicle for arbitrary new behavior after deployment.
Referencing a credential file for device-bearer authentication indicates the skill relies on locally stored account credentials to reach an external service. In the context of a media-generation skill, this is more dangerous because the capability is not obviously required by the described purpose, and any misuse, overbroad access, or leakage of the credential file could enable unauthorized account access or data exfiltration.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization helper requests a very broad OAuth scope set, including wallet spending, task control, music generation, voice write access, and artifact read access, which substantially exceeds the stated purpose of producing fund-dividend talking video clips from user content. If the credential is issued or later reused by shared components, compromise or misuse of this skill grants access to unrelated high-risk capabilities and violates least privilege.
The client contains substantial behavior unrelated to the stated purpose of generating fund-dividend talking clips, including self-update logic, installation registration, and persistent local inventory tracking. This broadens the attack surface and gives the package ongoing code-management and telemetry capabilities that can be abused if the vendor infrastructure is compromised or if users did not knowingly consent to such behavior.
The package can download, validate, and replace its own files, including scripts, which creates a built-in self-modification channel. Even with checksum validation, this makes the skill capable of changing its behavior after installation and turns compromise of the update supply chain or signing/discovery path into direct code execution on the host.
The code fingerprints the host by collecting platform, OS, version, architecture, locale, timezone, route selection, install source, and installation identifiers, then transmits that metadata during registration. For a skill whose stated purpose is media generation, this is unnecessary telemetry that can enable user/device profiling and increases privacy and tracking risk beyond user expectations.
The exposed self-update capability allows the skill to modify its own installed code, which is a powerful and risky behavior for a runtime client. In the context of a simple media-generation skill, this materially increases the consequences of any supply-chain compromise, misconfiguration, or unauthorized update path because the package can replace code locally without external package-manager controls.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The uninstall script manages a shared Beatra connection, credential lifecycle, and cross-skill inventory under ~/.beatra, which is unrelated to the advertised purpose of generating fund-dividend talking clips. Even if framed as cleanup logic, this gives the skill authority over global device state shared by other skills, creating unnecessary security-sensitive behavior and an opportunity to disrupt unrelated functionality.
Referencing credentials.json as part of the files this script removes indicates the skill is aware of and authorized to manipulate credential-bearing storage. In a skill whose declared purpose is video generation, access to authentication material is over-privileged and increases the blast radius if the package is modified, abused, or executed unexpectedly.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
This code can revoke a shared device token and delete state files in ~/.beatra, affecting all skills on the device rather than only this package. In the context of a media-creation skill, such authority is unjustified and dangerous because misuse, bugs, or packaging abuse could disconnect other installed skills or erase shared operational state.
The _device_token function reads an access token from ~/.beatra/credentials.json and uses it for server-side revocation. Direct token handling inside an unrelated content-generation skill violates least privilege and exposes sensitive authentication data to package code that does not need it for its stated function.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool/permission scope even though its documented workflow uses shell, network, local file access, and writes state. Without least-privilege constraints, a host may grant broader capabilities than necessary, increasing the blast radius if the bundled client or referenced operations are abused or compromised.
The skill documentation includes automatic self-update behavior that is not essential to producing dividend talking clips. Any self-modifying mechanism increases supply-chain and persistence risk because future code can change after initial review, especially when the skill already has network and file-modification capabilities.
The skill states that newer versions install automatically without separate confirmation, but this system-modifying behavior is not prominently disclosed up front in the core description or permissioning model. Hidden or understated auto-install behavior undermines informed consent and makes unexpected code changes more likely to be accepted silently.
The changelog states that users in mainland China are routed through a specific mainland network and may be redirected to an international approval/sign-in page, but it does not indicate explicit opt-in, security properties, or user control over that routing. Region-specific traffic steering and alternate sign-in flows can expose users to privacy, compliance, and phishing-like trust risks if the behavior is automatic or insufficiently disclosed.