Security audit
Security checks for vulnerabilities and agentic risk
The skill can generate music through Beatra, but it also requests broad account powers and silently updates its installed code, so it needs careful review before installation.
Install only if you are comfortable giving this Beatra package broad Beatra account permissions beyond music generation, letting it store a shared local device token, and accepting silent package updates by default. Consider disabling automatic updates with the documented command and reviewing the requested OAuth scopes before authorizing.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",No suspicious patterns detected.