Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Beatra image-to-video integration, but it asks users to accept broad shared account authority and silent self-updating code that go beyond a narrow photo-animation workflow.
Review this skill before installing if you are not comfortable with a shared Beatra device token that can access multiple Beatra media/account capabilities, spend credits after workflow approval, send limited installation metadata, and silently update the package by default. Disable automatic updates with the documented update command if you want to review changes before replacement.
A media-generation skill that also supports uninstall, credential revocation, local state inspection, and deletion of configuration files is performing lifecycle and account-management operations outside its declared role. That broadens the blast radius: a user invoking animation functionality may unknowingly enable destructive actions affecting local configuration and account access.
A media-generation skill that also supports uninstall, credential revocation, local state inspection, and deletion of configuration files is performing lifecycle and account-management operations outside its declared role. That broadens the blast radius: a user invoking animation functionality may unknowingly enable destructive actions affecting local configuration and account access.
A media-generation skill that also supports uninstall, credential revocation, local state inspection, and deletion of configuration files is performing lifecycle and account-management operations outside its declared role. That broadens the blast radius: a user invoking animation functionality may unknowingly enable destructive actions affecting local configuration and account access.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization flow requests a very broad OAuth scope set including artifacts write/read, image/video/music/speech generation, voice management, task control, and wallet spending, which materially exceeds what an image-to-motion skill appears to need. If the credential is misused, compromised, or reused by other helpers sharing ~/.beatra, it could enable unauthorized spending and unrelated content-generation actions under the user's account.
Requesting music:generate permission is not justified by the stated image-animation workflow. Even if not directly exploitable by remote input, unnecessary scope grants expand what a stolen or shared token can do and undermine informed user consent.
This client does substantially more than the advertised image-to-video function: it performs self-update, installation registration, route probing, install-source recording, and local skill inventory tracking. In the context of a creative media skill, this broadens the attack surface and grants persistent code-modification and telemetry capabilities that are not necessary to animate images, making compromise of the vendor infrastructure or misuse of the feature materially more dangerous.
The client can modify its own installed package files via self-update, which is inherently high risk in a skill whose advertised purpose is only image animation. Even though the implementation attempts integrity checks, self-modifying application logic significantly raises supply-chain impact: compromise of update metadata or signing/distribution processes can become remote code deployment to installed clients.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool restrictions while instructing use of shell execution, file access, network access, and local state manipulation. In a package that can upload files, invoke remote services, and modify installation state, missing scope boundaries materially increases the chance of overreach, unintended data access, or abuse if the skill or its helper script is compromised.
The skill states that newer releases install silently by default without separate confirmation. Even with integrity checks, automatic code replacement in a privileged helper that can access files, network resources, credentials, and paid APIs creates a supply-chain risk and removes the user's opportunity to review changed capabilities before execution.
The changelog states that in mainland China the helper now connects through a mainland network and may open an approval page on an international site, but it does not indicate explicit user consent, choice, or data-handling boundaries. Region-dependent routing can change where credentials and user data are sent, creating compliance, privacy, and trust risks, especially when the skill uses remote authentication and networked MCP access.
The document states that the client performs silent automatic update checks and automatically installs newer versions without separate confirmation. Even with integrity checks and rollback protections, silently replacing executable/package files by default reduces user control and can create supply-chain risk if the trusted update infrastructure or signing/verifying process is ever compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The file documents automatic installation registration and telemetry collection that is not necessary for an image-to-video skill's core function. Even if labeled non-billable and privacy-limited, it still introduces undisclosed network behavior and metadata collection beyond user-requested media processing, increasing privacy and supply-chain trust risk.
The documented behavior sends package, environment, network route, install source, locale, OS, architecture, Python version, language, and timezone data to a remote service on first use and periodically thereafter. For a media animation skill, this telemetry is unrelated to the stated purpose and creates unnecessary metadata exposure, fingerprinting potential, and covert communication concerns.
No suspicious patterns detected.