Security audit
Security checks for vulnerabilities and agentic risk
The skill does make school songs, but it also brings broad Beatra account, credential, telemetry, upload, uninstall, and silent self-update powers that are larger than this narrow purpose needs.
Review this carefully before installing. The visible song workflow asks before paid generation, but installing it also means trusting Beatra's bundled client, shared device token, telemetry registration, silent self-updates, and uninstall logic that can affect shared Beatra state. Disable auto-updates if you do not want the package to replace itself automatically, and install only if you are comfortable with a shared full-scope Beatra credential for all Beatra skills on the device.
The skill references uninstall/disconnect behavior that can inspect credentials, modify local application state, revoke authorization, and remove files under ~/.beatra. While such lifecycle functions may be legitimate, bundling them into a school-song skill creates a substantial trust gap and could lead to unexpected credential or state changes if invoked by mistake or through prompt manipulation.
The skill references uninstall/disconnect behavior that can inspect credentials, modify local application state, revoke authorization, and remove files under ~/.beatra. While such lifecycle functions may be legitimate, bundling them into a school-song skill creates a substantial trust gap and could lead to unexpected credential or state changes if invoked by mistake or through prompt manipulation.
The skill references uninstall/disconnect behavior that can inspect credentials, modify local application state, revoke authorization, and remove files under ~/.beatra. While such lifecycle functions may be legitimate, bundling them into a school-song skill creates a substantial trust gap and could lead to unexpected credential or state changes if invoked by mistake or through prompt manipulation.
The manifest explicitly references a local credential file at ~/.beatra/credentials.json for device-bearer authentication to a remote MCP endpoint. Exposing or relying on a filesystem credential path increases the chance of unintended secret access, leakage through logs/errors, or misuse by a compromised or overly permissive skill/tooling chain.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
The file documents an automatic installation registration call that reports package, platform, channel, network route, install source, and runtime metadata to a remote service. For a school song generation skill, this telemetry is unrelated to core functionality and creates an unnecessary data collection and outbound communication path that increases privacy and supply-chain risk.
The documented collection and transmission of installation metadata, network-route details, OS/version, architecture, Python version, locale, and time-zone offset enables device and environment fingerprinting without a clear connection to lyric or song creation. In this skill context, such data can support user tracking, infrastructure profiling, or targeting while offering little to no benefit to the advertised educational/music function.
The document instructs all packages to share a single full-scope device token from ~/.beatra/credentials.json, creating a high-value shared credential accessible across packages. In a skill ecosystem where package content is potentially adversarial, reusing one broad-scope token increases the blast radius: compromise of one package, helper script, or local file path can enable unauthorized API access for all packages using that credential.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization helper provisions a very broad OAuth scope set for a skill described as making school songs, including artifacts, images, videos, speech, voices, task control, and wallet spending. This violates least privilege and means that if the issued token is abused, the attacker could access or trigger capabilities far beyond the skill's stated purpose.
The scope bundle includes unrelated multimodal and account-management capabilities such as images:generate, videos:generate, speech:generate, voices:read, and voices:write, which exceed the stated school-song use case. Even if not immediately abused by this script, the resulting bearer token would be overpowered and increase blast radius if exposed or reused elsewhere.
The file embeds a full remote MCP client with routing logic, registration, uploads, approval handling, and update machinery, which is far broader than what a school-song generator needs. In this skill context, that capability expansion is dangerous because it gives a low-risk creative tool an unnecessary communications and control plane that could exfiltrate data, accept remote instructions, or change behavior over time.
The upload flow reads arbitrary local regular files and can send them to a remote service after obtaining upload instructions. That capability is much broader than needed for song generation and creates a direct path for sensitive local file exfiltration if the skill is invoked or extended inappropriately.
The skill can fetch remote discovery/manifest/archive data and overwrite its own installation, including silent auto-update behavior. In the context of a simple song-writing skill, self-modifying code is unjustified and materially raises supply-chain and persistence risk if the update channel is compromised or abused.
The exposed self-update command is an explicit self-modification capability that can replace package code after remote retrieval. In a school song maker, this is especially suspicious because the ability is unrelated to the stated purpose and expands persistence and supply-chain attack surface.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The uninstall script is designed to revoke a shared device credential and remove shared Beatra state under ~/.beatra, which affects all installed skills on the device, not just this package. Even though the code tries to preserve the connection unless it can prove no other skills remain, it still grants this unrelated song-making skill authority over cross-skill authentication state, creating unnecessary privilege and a high-risk blast radius if abused or modified.
The _STATE_FILES list includes shared files such as credentials.json, skills.json, registrations.json, and network.json under ~/.beatra, and _remove_local_state deletes them during uninstall. This means uninstalling a single school-song skill can erase global application state for all skills, causing denial of service and loss of shared configuration beyond the package's legitimate scope.
Referencing credentials.json as part of files the skill can delete indicates the package is aware of and permitted to manipulate shared credential storage. Even without exfiltration, giving a non-auth skill access to credential-bearing files is dangerous because it enables credential destruction, future misuse, and a broader attack surface around sensitive authentication material.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
The code constructs a revocation URL using local route state and performs authenticated device-token revocation, which is account/device authorization management unrelated to generating school songs. Embedding this capability in a content-generation skill expands the trust boundary unnecessarily and allows the package to influence the availability of other skills and the user's shared device authorization.
The _device_token function reads access_token from credentials.json and uses it for authenticated revocation requests. This is credential access by a skill whose advertised purpose is song generation, so the capability is unjustified by context and increases the risk of token misuse, unauthorized account actions, or adaptation into credential theft in a future update.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool scope while instructing use of a bundled client that can perform shell execution, network access, and local file operations. Even if these capabilities support legitimate music generation, the absence of least-privilege restrictions increases the blast radius if the skill is misused, modified, or invoked in an unexpected context.