Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its paid talking-clip purpose, but it uses broad shared Beatra account authority and silent self-updating that deserve Review before installation.
Install only if you trust Beatra with your fund-report inputs, still images, billing account, and a shared local device token. Review the requested Beatra permissions, consider turning automatic updates off with the documented command if you need pinned reviewed code, and use the workflow only with authorized likeness, voice, and report materials.
The skill references uninstall/disconnect and revocation behaviors that read and modify shared state under ~/.beatra, access credentials/inventory, make revocation requests, and delete local authorization state. Bundling administrative lifecycle operations into a media skill is risky because it can alter or remove shared account state and affect other installations or workflows unexpectedly.
The skill references uninstall/disconnect and revocation behaviors that read and modify shared state under ~/.beatra, access credentials/inventory, make revocation requests, and delete local authorization state. Bundling administrative lifecycle operations into a media skill is risky because it can alter or remove shared account state and affect other installations or workflows unexpectedly.
The skill references uninstall/disconnect and revocation behaviors that read and modify shared state under ~/.beatra, access credentials/inventory, make revocation requests, and delete local authorization state. Bundling administrative lifecycle operations into a media skill is risky because it can alter or remove shared account state and affect other installations or workflows unexpectedly.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The OAuth scope list requests far broader capabilities than are justified by the skill's stated purpose of producing fund-report talking clips. In addition to image/video/speech generation, it requests wallet spending, music generation, voice read/write, task cancellation, and broad artifact/task access, so a granted token could be abused to perform unrelated and sensitive account actions if the skill or its runtime is compromised.
Requesting wallet spending and voice/music management permissions is especially dangerous because these capabilities can directly trigger financial actions or modify reusable account assets beyond this skill's narrow media-assembly role. In the context of a fund-report clip generator, these permissions are unjustified and expand the blast radius from simple content generation to account abuse and unwanted charges.
The skill contains built-in self-modification capability that can replace its own installed files. In an agent skill whose stated purpose is media generation, self-updating executable code is dangerous because it changes the codebase after installation and, when combined with remote distribution infrastructure, creates a meaningful supply-chain and trust-boundary risk.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool restrictions despite requiring shell, file, network, and environment access via the bundled client. In a skill system, missing scope boundaries increases blast radius: the agent may be allowed to read local files, invoke commands, and make network requests beyond what is necessary, making abuse or prompt-induced misuse more likely.
The skill includes automatic self-update behavior for the bundled client, downloading and installing newer releases without separate confirmation. Even with signature/integrity claims, self-updating code in a content-generation skill introduces supply-chain risk and changes the executable behavior after review, undermining trust and making later exploitation or policy bypass harder to detect.
The changelog states that the helper may connect through a mainland-China-specific network and can open an approval page on an international site, but it does not indicate explicit user consent, data handling boundaries, or when this routing occurs. Region-specific routing and alternate sign-in flows can expose users to unexpected data jurisdiction, traffic redirection, or phishing-like consent confusion if the behavior is triggered automatically.
The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation. Even with integrity checks and fixed update sources, silent self-updating that replaces local files by default is a meaningful security and trust risk because users may be unaware that code on their system can change automatically, which increases supply-chain and operational exposure if the update channel is ever compromised or if an update causes unexpected behavior.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The documentation describes an automatic installation-registration telemetry call that is unrelated to the skill's stated purpose of generating fund-report talking clips. Even if framed as non-billable and best-effort, collecting package, platform, distribution, network-route, install-source, and runtime facts introduces undisclosed data collection behavior that expands the skill's privacy and attack surface beyond what users would reasonably expect from this functionality.
The documented collection of installation metadata, network route, install source, OS/version, architecture, Python version, interface language, and time-zone offset is not justified by the declared video-generation use case. Such telemetry can enable device fingerprinting, environment profiling, and user tracking across installs or networks, especially when combined with a stable installation reference and periodic reporting.
The helper launches browser-based authorization, persists credentials locally, and requests sensitive scopes, but its user messaging focuses on opening the approval page and completing sign-in rather than clearly disclosing the breadth of access being granted. This increases the risk of uninformed consent, especially because the requested capabilities exceed the apparent needs of the skill.