Security audit
Security checks for vulnerabilities and agentic risk
The skill can produce an influencer shortlist, but it also sets up broad shared Beatra credentials and silently self-updates local package code, so it belongs in Review before installation.
Install only if you are comfortable giving Beatra a reusable shared device credential with broad capabilities and allowing this package to silently update itself by default. Consider disabling automatic updates with the documented command, review the Beatra authorization scopes, and avoid using this in environments where shared local credentials or package-managed updates are not acceptable.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
_atomic_json(
credential_path,
{#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",No suspicious patterns detected.