Security audit
Security checks for vulnerabilities and agentic risk
The skill appears intended for Beatra media generation, but it deserves Review because it uses a shared broad Beatra token and silently self-updates installed code by default.
Install only if you are comfortable sending selected notices, stills, and generated media to Beatra under a shared paid Beatra authorization. Review the broad credential scope, default silent updates, and installation metadata registration; disable automatic updates with the documented update command if you need explicit update control.
The references indicate uninstall and credential revocation workflows that can read or delete local application state and revoke authorization, which is materially different from creating talking clips. Combining destructive account/system management behaviors with a content-creation skill makes accidental or coerced misuse more likely.
The references indicate uninstall and credential revocation workflows that can read or delete local application state and revoke authorization, which is materially different from creating talking clips. Combining destructive account/system management behaviors with a content-creation skill makes accidental or coerced misuse more likely.
The references indicate uninstall and credential revocation workflows that can read or delete local application state and revoke authorization, which is materially different from creating talking clips. Combining destructive account/system management behaviors with a content-creation skill makes accidental or coerced misuse more likely.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The skill requests a very broad OAuth scope set that substantially exceeds its stated purpose of creating talking clips from notices and still images. Overbroad authorization violates least privilege and increases blast radius if the credential is misused, leaked, or if the skill later performs actions outside the user's expected consent.
The inclusion of 'tasks:read' and 'tasks:cancel' allows inspection and termination of tasks that may be unrelated to this skill’s clip-generation workflow. In a shared account context, that can expose metadata about other operations and permit disruptive interference beyond the skill’s declared purpose.
The presence of self-update/self-modification capability means the skill can replace its own code after installation, which is a high-risk persistence and supply-chain mechanism. In this skill's context, that capability is not necessary for producing talking clips and therefore increases danger rather than being justified by function.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope even though its instructions require shell execution, local file access, network communication, and state-changing operations. Without a restrictive permission boundary, a host may expose broader capabilities than users expect, increasing the blast radius of prompt abuse, path mishandling, or unintended remote actions.
The skill includes automatic self-updating installation behavior unrelated to the advertised clip-generation function. Any code path that downloads and replaces package files changes the local execution environment and creates supply-chain, persistence, and trust-boundary risks, especially when triggered silently.
The skill states that newer versions install automatically without separate confirmation, but that system-changing behavior is not surfaced in the main description as a user warning. Silent updates alter code after initial approval, undermining user consent and increasing the risk of unnoticed malicious or defective changes.
The manifest declares a remote MCP endpoint and local stored credentials, but the user-facing metadata does not disclose that the skill will contact an external service and use persisted authentication material. This weakens informed consent and can lead users to submit merchant notices and images without realizing they are being sent off-device under an existing credential context.
The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation. Even with integrity checks and fixed sources, default silent self-updating that replaces local files creates a real supply-chain and user-consent risk because users may be unaware that executable behavior can change outside the original action they requested.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The documentation describes automatic installation-registration telemetry that is unrelated to the skill's stated purpose of generating merchant-inspection talking clips. Even though the data appears coarse and the call is described as best-effort and non-billable, it still introduces undisclosed metadata collection and external reporting behavior, including network-route and installation-source details, which expands the privacy and attack surface beyond user expectations.
The skill package includes capability to collect and report installation, environment, OS, architecture, locale, time-zone, install-source, and network-route metadata that is not needed for creating talking clips. This creates a privacy risk and supports fingerprinting of the host environment; in the context of a media-generation skill, such collection is unexpected and therefore more concerning because users would not reasonably anticipate background telemetry about their system and network path.