Security audit
Security checks for vulnerabilities and agentic risk
The skill is not clearly malicious, but it combines a still-image workflow with broad Beatra account authority and silent self-updating code, so users should review it carefully before installing.
Install only if you are comfortable giving this Beatra package a shared full-scope Beatra device token and allowing default silent package updates. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, and review Beatra account access and revocation options before using it for paid work.
The helper requests audio/video generation and voice read/write scopes that do not align with the described function of building a new-item launch board from images. These extra privileges enable unrelated actions and materially increase the harm possible from token compromise or later feature abuse.
A skill presented as a content studio also references uninstall, credential revocation, and deletion of local state under shared directories. Those system-management actions are materially different from generating images and can affect account access or local data, making the mismatch dangerous if triggered unexpectedly or through user confusion.
A skill presented as a content studio also references uninstall, credential revocation, and deletion of local state under shared directories. Those system-management actions are materially different from generating images and can affect account access or local data, making the mismatch dangerous if triggered unexpectedly or through user confusion.
A skill presented as a content studio also references uninstall, credential revocation, and deletion of local state under shared directories. Those system-management actions are materially different from generating images and can affect account access or local data, making the mismatch dangerous if triggered unexpectedly or through user confusion.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization helper requests a very broad OAuth scope set, including capabilities far beyond the skill's stated purpose of creating launch boards from still images. Over-scoped tokens violate least privilege and increase blast radius if the credential is misused, leaked, or if the skill later invokes unrelated APIs under the same authorization.
The helper requests audio/video generation and voice read/write scopes that do not align with the described function of building a new-item launch board from images. These extra privileges enable unrelated actions and materially increase the harm possible from token compromise or later feature abuse.
The file implements a broad remote-control client with generic MCP requests, uploads, telemetry, approval collection, and package update logic, which materially exceeds the stated purpose of creating launch boards from images. In a creative-content skill, this mismatch increases risk because the package can communicate with remote infrastructure and manipulate local state in ways users would not reasonably expect from the advertised functionality.
The package contains self-update logic that downloads archives from remote endpoints and replaces installed local files. Even with checksum and manifest validation, this is a powerful code-modification capability unrelated to the advertised creative purpose, and it turns the skill into a remotely changeable component after installation.
The command runner exposes generic remote MCP tool listing and arbitrary tools/call execution rather than restricting behavior to the skill's declared launch-studio workflow. That means the package can act as a general-purpose proxy to remote capabilities, greatly broadening what the skill may do beyond user expectations and making misuse or policy evasion easier.
The CLI exposes a self-update command that can modify the installed package on disk. In a skill advertised for producing launch imagery, shipping built-in self-modification is unjustified and dangerous because it enables remote code evolution and local file replacement outside the user's expected creative workflow.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope even though it instructs use of shell, file access, network access, and package update behavior. Missing least-privilege constraints makes it easier for a creative/image-generation skill to exercise broader capabilities than users would reasonably expect, increasing risk if the package or referenced scripts are compromised.
The skill includes self-updating package behavior that downloads and replaces local package files, which is unrelated to generating launch stills. Even with claimed verification, automatic code replacement expands the trust boundary and creates a supply-chain and execution risk if the update channel, signing, or client is compromised.
The manifest presents a creative image studio, but the runtime behavior includes remote auto-update downloads and local file replacement. Hidden software-management behavior weakens transparency and allows code changes after installation without users appreciating that the skill can modify itself.
The skill states that it silently auto-installs newer versions at most once every 24 hours, but there is no just-in-time warning or consent before installation occurs. Silent update behavior is risky because executable behavior can change without contemporaneous user awareness, which is especially sensitive for a skill with file, network, and credential-related capabilities.
The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation. Even with integrity checks and rollback protections, unattended file replacement is system-modifying behavior that can surprise users, expand the blast radius of any upstream compromise, and reduce meaningful user consent.