Security audit
Security checks for vulnerabilities and agentic risk
This skill is for making legal explainer clips, but it also carries broad Beatra account access, shared local credentials, and silent self-updating code, so it should be reviewed before installation.
Install only if you are comfortable connecting a Beatra account with a shared local Device Token, allowing approved actions to spend Beatra credits, and allowing this package to auto-update its own files by default. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, and revoke the device authorization from the Beatra Console if you no longer want the connection.
A legal clip skill should not also be able to inspect installation state, access or delete local files under ~/.beatra, revoke tokens, uninstall packages, or manage shared credentials for other skills. Those behaviors cross trust boundaries from content generation into local system and account administration, creating a path to denial of service, credential disruption, or tampering with other installed skills.
A legal clip skill should not also be able to inspect installation state, access or delete local files under ~/.beatra, revoke tokens, uninstall packages, or manage shared credentials for other skills. Those behaviors cross trust boundaries from content generation into local system and account administration, creating a path to denial of service, credential disruption, or tampering with other installed skills.
A legal clip skill should not also be able to inspect installation state, access or delete local files under ~/.beatra, revoke tokens, uninstall packages, or manage shared credentials for other skills. Those behaviors cross trust boundaries from content generation into local system and account administration, creating a path to denial of service, credential disruption, or tampering with other installed skills.
Automatic software update with local file replacement is context-inappropriate for a legal explainer content skill and grants it effective code-modification capability on the host. If the update channel, verification logic, or upstream package is compromised, the skill could replace local package files and gain persistent malicious execution without clear user awareness.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
The documentation directs all packages to share a single full-scope device token from a fixed credentials file, creating broad implicit trust and privilege sharing across packages. In a skill context, any compromised or overly permissive package that can invoke the bundled client may inherit high-value MCP access, increasing blast radius and enabling unauthorized actions without re-authorization.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The requested OAuth scope is far broader than needed for a legal explainer clip skill: it includes wallet spending plus image, video, music, speech, and voice capabilities beyond the narrowly described function. If this credential is misused or the skill is compromised, the excessive scope expands blast radius to billing abuse, unauthorized content generation, and access to unrelated user resources.
The client performs substantial non-core behavior for a legal explainer skill, including self-updating code, installation registration, route management, and local inventory tracking. This broadens the trust boundary and creates a supply-chain and privacy risk: a marketing/video skill can alter its own code and report host/install metadata unrelated to the user-visible task.
The skill can download manifests and archives from remote infrastructure and replace files in its own installation directory. Even with checksum validation, this is a self-modifying update channel embedded in a content-generation skill, which materially increases supply-chain risk because a compromised update source can change future behavior without normal package-manager controls.
Exposing a self-update command in the shipped skill makes runtime code replacement a built-in feature. In the context of a legal explainer marketing tool, this is more dangerous because users would not reasonably expect the skill to modify its own installed code, and it creates a direct supply-chain control plane for future behavior changes.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope or permission boundaries while instructing use of shell, network, file access, and environment-adjacent capabilities through a bundled client. That creates unnecessary ambient authority and makes it difficult for a host to constrain what the skill can access or modify, increasing the blast radius if the client or referenced workflows are compromised.
The skill documentation explicitly includes silent self-update and package replacement behavior, which is unrelated to generating legal explainer media. Silent code replacement creates a supply-chain risk because the skill's behavior can change after initial review, undermining trust and enabling unnoticed introduction of malicious or unsafe functionality.
Describing silent automatic updates without upfront warning about system modification normalizes hidden changes to local software. That reduces informed consent and makes it easier for risky or compromised updates to be applied without users realizing the skill can alter installed files.
The changelog states that users in mainland China now connect through a specific mainland network, which is a locale-specific behavior. Because this is presented as a default routing policy rather than an explicit opt-in or clearly documented compliance requirement, it may violate language/locale policy constraints.
The document states that the client silently checks for updates and automatically installs them without separate confirmation. Even though the text describes integrity checks and rollback protections, unattended code replacement is a meaningful user-impacting behavior that can violate user expectations, change runtime behavior unexpectedly, and increase supply-chain blast radius if the update channel is ever compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client