Security audit
Security checks for vulnerabilities and agentic risk
This cover-making skill is not clearly malicious, but it uses a broad shared Beatra account token and silently updates its own installed files, so users should review it before installing.
Review the Beatra authorization carefully before installing. This skill uploads selected images to Beatra, stores a shared Beatra token under ~/.beatra, can spend Beatra credits for approved generation calls, registers installation metadata, and silently updates its own package by default. Consider disabling auto-updates with `python3 scripts/mcp_client.py update --auto off` and revoke the device from the Beatra Console if you no longer want the shared token active.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",No suspicious patterns detected.