Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Beatra video-generation skill, but it grants and maintains broader account/device authority than the advertised Instagram product-video workflow needs.
Install only if you are comfortable giving this Beatra package a shared full-scope device connection, paid-credit authority, task access/cancellation capability, installation telemetry, and default silent self-updates. Consider disabling automatic updates after install and avoid using it if you require narrow per-skill permissions or per-update approval.
The skill appears to encompass uninstall flows, local state inspection and modification under ~/.beatra, token revocation, and deletion of local credential/configuration data despite being described as a video-creation tool. Such undisclosed administrative capabilities are risky because they can alter or remove local account state and affect other installed components beyond the narrow media workflow users expect.
The skill appears to encompass uninstall flows, local state inspection and modification under ~/.beatra, token revocation, and deletion of local credential/configuration data despite being described as a video-creation tool. Such undisclosed administrative capabilities are risky because they can alter or remove local account state and affect other installed components beyond the narrow media workflow users expect.
The skill appears to encompass uninstall flows, local state inspection and modification under ~/.beatra, token revocation, and deletion of local credential/configuration data despite being described as a video-creation tool. Such undisclosed administrative capabilities are risky because they can alter or remove local account state and affect other installed components beyond the narrow media workflow users expect.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The OAuth scope string requests a very broad set of permissions, including artifacts, images, videos, music, speech, voices, wallet spending, and task operations, while the skill is described as generating product-detail clips from Instagram stills. This violates least privilege and means compromise or misuse of the skill grants capabilities far beyond its stated purpose, increasing blast radius substantially.
The inclusion of tasks:cancel is not obviously justified by a narrowly scoped content-generation tool and enables interference with other running operations associated with the same account. In a shared credential model, that capability can be misused to disrupt unrelated jobs, which makes the over-scoping more dangerous in context.
The client implements a broad remote-control substrate: generic MCP sessions, arbitrary tool invocation, upload support, route management, installation registration, and self-update behavior that far exceed the stated purpose of converting Instagram reels into PDP clips. In a narrowly scoped media skill, this capability expansion increases the blast radius if the backend, package feed, or skill configuration is abused, effectively turning the skill into a general remote operations client.
The CLI exposes generic remote tool enumeration and invocation commands ('tools' and 'call') that are not justified by the skill's narrow business purpose. In context, this turns a product-video skill into a general-purpose remote execution gateway mediated by the MCP backend, making misuse or backend compromise substantially more dangerous.
The client includes self-modification capability through its update command and supporting update logic, allowing the package to replace its own files. In a narrowly scoped skill, self-modifying behavior materially increases supply-chain and persistence risk, because future code can change outside the initially reviewed artifact, especially when paired with silent auto-update functionality.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope even though its instructions clearly require shell execution, local file access, network access, and interaction with local state and update mechanisms. Missing permission boundaries increases the chance that a host agent grants broader capabilities than users expect, making misuse or overreach harder to constrain or audit.
The skill states that the bundled client silently checks for and installs newer releases automatically without separate confirmation. Even if updates are signed and verified, silent package replacement is system-modifying behavior that can change executable logic after review, undermining user consent and increasing supply-chain risk if the update channel or signing process is ever compromised.
The changelog states that users in mainland China are routed through a different network and may be sent to an alternate international approval page, but the manifest shows no explicit consent, region disclosure, or user-controlled opt-in for this routing behavior. Locale-dependent authentication or traffic routing can affect privacy, compliance, and trust boundaries, especially when users may unknowingly interact with different infrastructure.
The document states that the client silently checks for updates by default and automatically installs newer versions without separate confirmation, but it does not present a prominent user-facing warning about background file replacement or its operational impact. Silent self-update behavior changes installed code without an explicit opt-in at the time of installation or first use, which can undermine user consent, surprise operators, and create supply-chain risk if the update channel is ever compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The inclusion of tasks:cancel is not obviously justified by a narrowly scoped content-generation tool and enables interference with other running operations associated with the same account. In a shared credential model, that capability can be misused to disrupt unrelated jobs, which makes the over-scoping more dangerous in context.
No suspicious patterns detected.