Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Beatra content-generation skill, but it needs Review because it uses a broad shared spending credential and silent self-updates that can replace package files after installation.
Review this skill before installing. Only proceed if you trust Beatra with a shared local Device Token that can spend credits through Beatra tools, and consider disabling automatic updates with the documented update --auto off command if you need every package change to be explicitly approved.
A skill framed as a post-generation workflow should not implicitly include uninstall logic, credential revocation, deletion of local state, and filesystem inspection without clear user awareness. These are destructive or administrative actions unrelated to ordinary content creation, so hiding them behind a benign description raises the risk of unauthorized local changes and loss of credentials or configuration.
A skill framed as a post-generation workflow should not implicitly include uninstall logic, credential revocation, deletion of local state, and filesystem inspection without clear user awareness. These are destructive or administrative actions unrelated to ordinary content creation, so hiding them behind a benign description raises the risk of unauthorized local changes and loss of credentials or configuration.
A skill framed as a post-generation workflow should not implicitly include uninstall logic, credential revocation, deletion of local state, and filesystem inspection without clear user awareness. These are destructive or administrative actions unrelated to ordinary content creation, so hiding them behind a benign description raises the risk of unauthorized local changes and loss of credentials or configuration.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The requested OAuth scope is far broader than the stated purpose of a trend-content creation skill. In addition to content-related capabilities, it asks for wallet:spend, task control, and multiple generation domains, so a compromised or overly curious skill would gain authority to spend funds and access or manipulate artifacts/tasks beyond what users would reasonably expect from this workflow.
The file embeds a large self-updating client and installer framework that is not necessary for a 'hot-topic content maker' workflow. Even though it includes checksum and path-safety controls, it still enables remote code replacement of the installed package, materially expanding the attack surface and creating a supply-chain compromise path if the update channel, discovery endpoint, or signing assumptions fail.
The package explicitly exposes a self-update capability that can rewrite its own installed files. Even with validation checks, self-modifying code is high-risk in a third-party skill because it enables post-installation code changes and creates a supply-chain control channel unrelated to the advertised content-making functionality.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The package explicitly targets credentials.json as part of the shared Beatra state it manages. Direct awareness and handling of credential storage inside a non-authentication skill increases the blast radius of any compromise and is inconsistent with least privilege for a content-generation tool.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
This script can perform a network revocation of shared device authorization by constructing a revoke URL and POSTing the bearer token. That is a powerful account/device-management capability unrelated to content creation, and if abused or triggered unexpectedly it can disconnect all skills sharing that authorization.
The _device_token function reads the bearer access token directly from credentials.json so the skill can submit revocation requests. Direct token access is highly sensitive; if the skill or its supply chain were compromised, the token could be exfiltrated or misused for unauthorized API actions beyond uninstall.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill advertises substantial capabilities involving shell, network, file, and environment access but does not declare any explicit tool scope or allowlist. That creates an unnecessarily broad execution surface and weakens host-side containment, making it easier for the workflow or bundled client to access sensitive local resources beyond what a content-generation skill should need.
The manifest description presents a very wide set of activation cues such as bringing any 'hot topic, moment, or seasonal peg' or simply naming a topic to have the skill act. For a markdown/manifest file, this is vague enough to overlap with common social-content requests and does not define tighter trigger boundaries or negative examples.
The skill enables silent automatic updates of bundled client software without prominent upfront disclosure in the main skill description. Even with verification controls described later, silent code changes alter the executed trust boundary after approval and can introduce new behavior or bugs without renewed user consent.
The changelog states that 'In mainland China the helper now connects through Beatra's mainland network' and otherwise may open an approval page on the international site. This introduces a locale-specific behavior based on region, but the manifest does not indicate user opt-in or a clearly documented policy justification for forcing that locale/network path.
The document states that the client performs silent update checks by default and automatically installs newer releases without separate confirmation. Even though integrity checks and rollback are described, background network access plus unprompted file replacement reduces user awareness and control, creating a supply-chain and trust-boundary risk if update infrastructure, signing assumptions, or package ownership checks ever fail.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The authorization flow detects the host agent platform from environment variables and captures the machine hostname for persistence in host.json. For a social-content skill, this is unnecessary contextual fingerprinting that can reveal organizational naming, device identity, or deployment environment and increases privacy/security exposure if local state is later exfiltrated.
No suspicious patterns detected.