Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Beatra media-generation workflow, but it grants and maintains broader remote-tool and self-update authority than its renewal-video purpose requires.
Install only if you are comfortable granting Beatra a persistent device authorization that can spend credits, upload selected media, read and manage Beatra tasks/artifacts, and auto-update this package. Turn off automatic updates if you want manual control, and review Beatra account/device access if you later uninstall.
The helper asks for broad task and artifact management capabilities beyond what is obviously necessary for a one-photo, one-clip reminder workflow. Even if some artifact read/write access is legitimate, bundling additional task read/cancel and broad artifact permissions increases data exposure and operational control beyond the declared purpose.
The skill references uninstall/disconnect behavior and package/state removal guidance that is unrelated to the declared task of producing talking renewal clips. Even if not directly executed in normal use, bundling destructive account/state-management capabilities with a content-generation skill increases the chance of misuse, user confusion, or accidental invocation affecting local Beatra state and credentials.
The skill references uninstall/disconnect behavior and package/state removal guidance that is unrelated to the declared task of producing talking renewal clips. Even if not directly executed in normal use, bundling destructive account/state-management capabilities with a content-generation skill increases the chance of misuse, user confusion, or accidental invocation affecting local Beatra state and credentials.
The skill references uninstall/disconnect behavior and package/state removal guidance that is unrelated to the declared task of producing talking renewal clips. Even if not directly executed in normal use, bundling destructive account/state-management capabilities with a content-generation skill increases the chance of misuse, user confusion, or accidental invocation affecting local Beatra state and credentials.
This documentation introduces a bundled self-updating client that is unrelated to the stated insurance-renewal talking-clip functionality, which is a strong indicator of hidden or unnecessary capability. Even if the updater includes integrity checks, an automatic code-replacement mechanism materially expands the attack surface and can be abused to change runtime behavior outside the user’s expected task scope.
Silent automatic installation of new versions without separate confirmation is unjustified for a content-generation skill and creates a covert path for modifying code after installation. In this skill context, that mismatch makes the behavior more dangerous because users would not reasonably expect background software replacement when generating reminder clips.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The OAuth scope set requested by this authorization helper is far broader than the skill's stated purpose of producing insurance renewal reminder talking clips. Requesting unrelated capabilities such as music generation, broad artifact/task operations, and voice management violates least privilege and materially increases blast radius if the token is stolen, reused, or the skill behaves unexpectedly.
The helper asks for broad task and artifact management capabilities beyond what is obviously necessary for a one-photo, one-clip reminder workflow. Even if some artifact read/write access is legitimate, bundling additional task read/cancel and broad artifact permissions increases data exposure and operational control beyond the declared purpose.
The file implements a broad remote-control client with credential handling, arbitrary remote MCP access, uploads, route probing, telemetry, installation registration, inventory tracking, and package self-update, which materially exceeds the declared purpose of generating insurance-renewal talking clips. In a skill context, this expansion of capability increases attack surface and trust requirements: compromise of the remote service or misuse of the generic client can affect the host beyond the narrow creative task users expect.
The self-update subsystem downloads manifests and archives from remote infrastructure and then overwrites files in the installed package. Even with checksum validation and path-safety checks, this introduces a powerful remote code modification channel unrelated to the stated creative function; if the vendor infrastructure, signing assumptions, or distribution pipeline are compromised, the skill can be turned into a host-resident malware updater.
The command path supports listing all remote tools and calling an arbitrary tool name with JSON arguments from stdin, making the client a generic broker to the remote MCP service rather than a single-purpose insurance reminder generator. In this skill context that is especially dangerous because it allows functionality unrelated to the advertised workflow, enabling remote capability expansion and abuse through the same trusted installation.
The presence of a self-update command means the package can modify its own installed code after deployment. In a skill whose purpose is limited to generating reminder clips, self-modification is unusually sensitive because it enables post-install behavior changes and amplifies any compromise of the update channel into arbitrary future code execution on the host.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill invokes shell commands, reads local files, uploads local artifacts, performs network operations, and references local state and update behavior, but it does not declare a restrictive tool scope such as allowed-tools or permissions. That increases the blast radius because a host may grant broader capabilities than users expect, making sensitive local data access and external communication less transparent and less controllable.
The skill states that the bundled client silently installs newer releases automatically without separate confirmation. Silent self-updating changes code on the system after initial trust is granted, which increases supply-chain and integrity risk, especially because the skill description does not prominently warn users about this system-modifying behavior before adoption.
The changelog states that users in mainland China are routed through a specific network path and may be redirected to an alternate international approval page, without clear indication of user control, rationale, or security properties. Region-specific routing and sign-in path switching can create phishing, compliance, privacy, and traffic interception concerns, especially when tied to authentication flows.