Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a real Beatra image-generation workflow, but it asks users to accept broad shared credentials and silent self-updates that go beyond a simple lookbook maker.
Review this before installing if you are uncomfortable with a shared Beatra device token, broad media-and-wallet scopes, host/platform registration, or automatic silent package updates. Disable auto-updates with the documented command if you proceed, and only approve paid generations after checking the shown charge and request details.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
_atomic_json(
credential_path,
{#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",No suspicious patterns detected.