Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly does what it says, but it asks for broad account authority and silently updates its own package files by default.
Review before installing. This skill requires a Beatra account connection, keeps a persistent local token, can spend credits on approved generation tasks, sends limited installation/runtime registration data, and silently updates its own package unless disabled with the documented update command.
The requested music:generate capability is not supported by the skill description, which discusses trading-calendar talking clips from still photos. While less severe than wallet access, unnecessary media-generation rights still enlarge the token's abuse surface and violate least-privilege expectations.
The skill description does not indicate that it can uninstall packages, inspect local installation inventory, revoke authorization, and delete files under local application state. Those are sensitive administrative actions unrelated to the stated business purpose, and hiding them behind a benign media workflow creates significant trust and integrity risk.
The skill description does not indicate that it can uninstall packages, inspect local installation inventory, revoke authorization, and delete files under local application state. Those are sensitive administrative actions unrelated to the stated business purpose, and hiding them behind a benign media workflow creates significant trust and integrity risk.
The skill description does not indicate that it can uninstall packages, inspect local installation inventory, revoke authorization, and delete files under local application state. Those are sensitive administrative actions unrelated to the stated business purpose, and hiding them behind a benign media workflow creates significant trust and integrity risk.
The manifest explicitly references a local credential file used for device-bearer authentication to a remote MCP service. In the context of an innocuous-seeming calendar-to-video skill, access to persistent credentials is dangerous because it can enable unauthorized use of the user's Beatra account or remote actions beyond the narrowly described task if the skill or connected service is abused.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Claiming that one approval covers image, video, music, speech, upload, model, and task tools materially exceeds the manifest's narrowly described purpose. In this context, the skill could obtain user authorization for a much broader tool surface than needed, enabling misuse of unrelated media or model capabilities under the guise of a simple market-calendar talking-clip tool.
The documentation instructs use of a bundled generic MCP client for tool discovery and arbitrary tool invocation against an external endpoint. That is significantly broader than a fixed-purpose clip-generation skill and effectively exposes a general remote action surface that could be repurposed beyond the advertised function.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization helper requests a very broad OAuth scope set, including artifacts, images, videos, music, speech, voices, tasks, and wallet spending, far beyond the stated purpose of producing market-calendar talking clips from photos. Overbroad scopes violate least privilege and materially increase blast radius if the credential is abused, leaked, or the skill behaves unexpectedly.
The requested music:generate capability is not supported by the skill description, which discusses trading-calendar talking clips from still photos. While less severe than wallet access, unnecessary media-generation rights still enlarge the token's abuse surface and violate least-privilege expectations.
The file implements a full self-update mechanism that downloads archives and replaces local package files, functionality far outside the declared creative purpose of the skill. Although there are integrity checks, this substantially enlarges the attack surface: compromise of the update channel, signing process, or vendor infrastructure can turn routine skill use into arbitrary code replacement on the host.
The client performs installation registration and inventory reporting that go beyond the skill's declared purpose of generating trading-calendar talking clips. It transmits package, installation, route, platform, and environment metadata to a remote service on normal use, creating a privacy and trust-boundary issue because these side effects are unrelated to the user-requested media workflow.
The skill exposes self-modifying behavior through a built-in self-update command, allowing local package bytes to be replaced by network-fetched content. In the context of a media-generation skill, self-modification is especially concerning because it is unrelated to core functionality and creates a path for persistent code changes on the host.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill invokes shell commands, reads local files, uploads artifacts, and performs network operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a least-privilege failure: the host cannot clearly constrain what the skill is permitted to access, and users are not adequately warned about the operational surface.
The skill includes a self-updating mechanism that downloads and replaces package-owned files automatically, which is unrelated to generating trading-calendar videos. Any self-modifying capability increases supply-chain risk: if the update channel, verification logic, or package trust boundary fails, the skill can change behavior after review without fresh user approval.
The automatic update behavior modifies installed files without prominent disclosure in the user-facing skill description. Even if intended for maintenance, silent file replacement is a material system change that users should knowingly authorize, especially in a skill that already performs network and local-state operations.
The changelog states that users in mainland China are routed through a specific mainland network and may be redirected to an international approval page, without any visible user choice or clear rationale in the manifest. Region-specific routing and approval behavior can alter trust boundaries, expose user metadata, and create consent and compliance risks, especially when undisclosed in a simple media-generation skill.