Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its advertised Beatra video-making purpose, but it should go to Review because it uses a broad shared Beatra token and silently self-updates local package code by default.
Review before installing if you are not comfortable with a shared Beatra device token, broad media/billing scopes, coarse installation registration, and default silent package updates. After install, run `python3 scripts/mcp_client.py update --auto off` if you want to disable silent updates, and approve paid image, speech, and video calls only after checking the displayed estimate.
The same package apparently includes uninstall/disconnect functionality, credential/state file modification, installed-skill inspection, and remote revocation steps, none of which are part of generating promo videos. Bundling administrative lifecycle operations with a content-creation skill expands local-system impact and creates a confusing, over-privileged trust model.
The same package apparently includes uninstall/disconnect functionality, credential/state file modification, installed-skill inspection, and remote revocation steps, none of which are part of generating promo videos. Bundling administrative lifecycle operations with a content-creation skill expands local-system impact and creates a confusing, over-privileged trust model.
The same package apparently includes uninstall/disconnect functionality, credential/state file modification, installed-skill inspection, and remote revocation steps, none of which are part of generating promo videos. Bundling administrative lifecycle operations with a content-creation skill expands local-system impact and creates a confusing, over-privileged trust model.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The helper requests a very broad OAuth scope set, including wallet:spend, tasks:*, artifacts:*, voices:*, and multiple generation capabilities. For a skill described as making narrated promo videos, bundling spending and unrelated account/task permissions violates least privilege and would let a compromised or abusive skill act far beyond the advertised purpose.
The client implements self-update, installation registration, and local device inventory behavior that is materially broader than the advertised novel-video creation purpose. Even though parts of the updater include integrity checks, silent code replacement plus outbound registration create a supply-chain and unauthorized-functionality risk surface that can change behavior after installation without an in-context user decision.
Self-modifying update capability is dangerous in an agent skill because it allows the installed codebase to replace itself outside the original review and trust decision. Although this implementation verifies manifests and checksums, the capability still expands the attack surface for supply-chain compromise, malicious publisher action, or unexpected functionality drift after deployment.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope even though it directs use of capabilities equivalent to shell, file access, network, and environment interaction via a bundled client. Without restrictive allowed-tools or permissions, the runtime may grant broader access than necessary, increasing blast radius if the skill or its dependencies are compromised.
The routing text says to use the skill whenever the user has story text and wants a finished narrated video, then lists a wide range of content types and use cases. It does not provide clear exclusions or negative examples, so the activation scope is broad enough that ordinary requests about story content or promotional media could be routed here unintentionally.
The skill includes automatic self-update and package replacement, which allows code execution behavior to change after installation without a fresh review of the exact version being run. Even with claimed verification, this materially increases supply-chain risk and is unrelated to the core task of making narrated promo videos.
Automatic package updates are enabled in the runtime notes but are not surfaced in the top-level description users would rely on to understand the skill. This reduces informed consent and can lead to silent behavior changes in a package that already has local file, network, and shell-like reach.
The changelog states that in mainland China the helper now connects through Beatra's mainland network, which is a locale-specific behavior described as automatic rather than user-selected. Under the policy, forcing a specific language or locale behavior without opt-in or a clearly documented justification is a natural-language policy concern.
The documentation describes a silent automatic self-update mechanism that downloads and installs new code before ordinary commands, which is outside the stated purpose of a story-video generation skill. Even with integrity checks and fixed endpoints, this expands the trust boundary to remote infrastructure and creates a supply-chain execution path that can modify local files without a task-specific need.
A silent network-based self-update capability is unjustified for a novel promo video maker and introduces an unnecessary remote code and file modification channel. Because it runs automatically and may switch network endpoints across regions, compromise of update infrastructure or configuration could lead to unauthorized code deployment on user systems.
The file states that higher versions are installed automatically without separate confirmation, but does not provide an explicit user-facing warning that local package files will be modified by default. This undermines informed consent and can surprise users with code changes, making abuse or accidental breakage harder to detect and contest.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
No suspicious patterns detected.