Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to make the advertised shift-handoff voice clips, but it also asks for broad reusable Beatra account authority and can silently update its own package files.
Install only if you trust Beatra with a reusable device authorization that can do more than this one voice workflow. Consider disabling automatic updates with the documented command, keeping limited account balance, and revoking the device authorization from the Beatra Console when finished.
The helper also asks for voices:read, voices:write, tasks:read, tasks:cancel, and broad artifact access, which go beyond simple one-off speech clip generation. In the context of a handoff voice-pack skill, these permissions could enable inventorying or modifying voices and interfering with task state outside the user's expectation.
A shift-handoff voice skill should not also encompass uninstall logic, shared credential inspection, state-file deletion, and device authorization revocation. Bundling destructive lifecycle and credential-affecting operations into a content-generation skill creates unnecessary risk of account disruption, accidental deletion, or abuse if the skill is triggered in unexpected contexts.
A shift-handoff voice skill should not also encompass uninstall logic, shared credential inspection, state-file deletion, and device authorization revocation. Bundling destructive lifecycle and credential-affecting operations into a content-generation skill creates unnecessary risk of account disruption, accidental deletion, or abuse if the skill is triggered in unexpected contexts.
A shift-handoff voice skill should not also encompass uninstall logic, shared credential inspection, state-file deletion, and device authorization revocation. Bundling destructive lifecycle and credential-affecting operations into a content-generation skill creates unnecessary risk of account disruption, accidental deletion, or abuse if the skill is triggered in unexpected contexts.
The manifest references a credential file in the user's home directory for bearer-based authentication to a remote service. Even if this does not directly exfiltrate the file, designing the skill around direct credential-file usage increases the chance of unauthorized token use, overbroad access, and sensitive credential exposure through logs, prompts, or compromised tooling.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
The document instructs all packages to rely on a single full-scope device token stored in ~/.beatra/credentials.json, creating a shared-credential model across packages. In a skill ecosystem where package content must be treated as potentially adversarial, referencing and normalizing access to a broad, reusable credential increases the blast radius of any package compromise or token-handling bug and may enable unauthorized API use under the user's identity.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization helper requests a very broad OAuth scope set, including artifacts, images, videos, music, speech, voice management, task control, and wallet spending, while the skill is described only as producing shift handoff voice clips. This violates least privilege and means that if the credential is misused, a compromise of this low-scope skill becomes a much broader account compromise.
The helper also asks for voices:read, voices:write, tasks:read, tasks:cancel, and broad artifact access, which go beyond simple one-off speech clip generation. In the context of a handoff voice-pack skill, these permissions could enable inventorying or modifying voices and interfering with task state outside the user's expectation.
The helper also asks for voices:read, voices:write, tasks:read, tasks:cancel, and broad artifact access, which go beyond simple one-off speech clip generation. In the context of a handoff voice-pack skill, these permissions could enable inventorying or modifying voices and interfering with task state outside the user's expectation.
The file implements a broad remote-control client with routing logic, uploads, registration, approval handling, and update infrastructure that substantially exceeds the declared purpose of generating shift handoff voice clips. This expands the attack surface and creates capability mismatch: a user expecting local or narrow audio processing instead receives a networked agent component with privileged package-management behavior.
The skill can silently download manifests and archives, validate them, and replace installed files in place. Even with checksum validation, this creates a remote code modification path unrelated to the stated voice-clip purpose; if the update channel or publisher is compromised, the skill becomes a delivery mechanism for arbitrary new code.
The skill exposes self-update functionality that can modify its own installed codebase. In the context of a simple voice-clip skill, self-modification is especially risky because it permits post-installation behavior drift and creates a standing path for remote code changes if the distribution or update infrastructure is compromised.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The function reads an access token from credentials.json and uses it to perform remote revocation, which is real access to sensitive authentication material. While the apparent purpose is cleanup rather than theft, the skill context makes this risky because an audio-generation skill should not need to read shared device credentials at all, and any code with token access could be modified or abused for broader account actions.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool/permission scope even though its instructions require shell execution, file access, network communication, and interaction with local state. Without a restrictive allowlist, an agent or runtime may grant broader capabilities than users expect, increasing the blast radius of prompt injection, mis-execution, or abuse of the bundled client.
The skill includes silent automatic self-update unrelated to its core task, and the update occurs without separate confirmation. Even with claimed verification, silent code replacement increases supply-chain and change-control risk because new executable behavior can be introduced after installation without a fresh user trust decision.
The changelog states that users in mainland China are routed through one network and others may be sent to an international approval page, but there is no indication of explicit user choice or transparent locale-based consent. Region-specific routing can expose users to unexpected data handling, different legal regimes, or phishing-like approval flows if silently triggered.
The manifest declares a remote MCP endpoint with device-bearer authentication even though the advertised skill purpose is simple checklist-to-voice conversion. That creates an unnecessary account-linked network dependency and expands the trust boundary to a remote service without clearly disclosing why user authentication or external access is needed.
The document states that the client silently checks for updates and installs them automatically without separate confirmation. Even with the described integrity checks, unattended self-update that replaces local files changes executable behavior without an explicit per-update user decision, which creates supply-chain and operational risk if the update channel, signing process, or release workflow is ever compromised.
No suspicious patterns detected.