Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly transparent about making paid Beatra avatar videos, but it bundles a shared full-scope credential flow and silent self-updating code that users should review before installing.
Install only if you are comfortable granting Beatra a shared device token with broad media, task, artifact, voice, and wallet-spend permissions, and with the bundled client checking for and installing package updates automatically. Review the auto-update setting and consider disabling silent updates with the documented command if you want explicit control over package changes.
References to uninstall/disconnect flows, credential file access under ~/.beatra, token revocation, and deletion of local state are unrelated to the claimed talking-avatar purpose. Combining destructive local-state operations with a benign-seeming media workflow raises risk of unintended credential exposure, state corruption, or surprise removal actions under an unexpectedly broad trust boundary.
References to uninstall/disconnect flows, credential file access under ~/.beatra, token revocation, and deletion of local state are unrelated to the claimed talking-avatar purpose. Combining destructive local-state operations with a benign-seeming media workflow raises risk of unintended credential exposure, state corruption, or surprise removal actions under an unexpectedly broad trust boundary.
References to uninstall/disconnect flows, credential file access under ~/.beatra, token revocation, and deletion of local state are unrelated to the claimed talking-avatar purpose. Combining destructive local-state operations with a benign-seeming media workflow raises risk of unintended credential exposure, state corruption, or surprise removal actions under an unexpectedly broad trust boundary.
This documentation describes a bundled client that silently self-updates before ordinary commands and installs newer releases without separate confirmation. Even with integrity checks, silent self-update is a powerful code-execution capability unrelated to a talking-avatar workflow, and its presence materially increases supply-chain and unauthorized-change risk if the update channel, signing process, or client is ever compromised.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The requested OAuth scope is far broader than the skill's stated purpose of creating talking-avatar videos. In addition to videos, it requests artifacts read/write, image generation, music generation, speech generation, voice read/write, task control, and notably wallet:spend, which creates an unnecessary financial and cross-capability risk if the token is compromised or the skill is misused.
The skill can download and apply updates that replace its own installed files, including the client script itself. Although the update path includes checksums and manifest validation, this still grants remote control over executable local code to an external service, which is far beyond the expected scope of a talking-avatar skill and becomes highly dangerous if the update infrastructure or signing authority is compromised.
The code exposes a self-update capability that can replace the package's own installed files, making the skill self-modifying. In the context of an agent skill whose stated purpose is talking-avatar video generation, this is unusually dangerous because it allows remote-delivered code changes that alter local behavior outside the user's expected task scope.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope even though it directs use of shell, network, file access, and likely environment-backed credential flows via the bundled client. Without a least-privilege declaration, a host may grant broader capabilities than necessary, increasing blast radius if the client, update path, or referenced workflows are abused.
The skill embeds self-updating package-management behavior that is not necessary for producing a talking-avatar video. Even with integrity checks described, self-update expands the trust boundary to code download and replacement, creating a supply-chain and persistence risk inappropriate for a narrowly scoped media-generation skill.
Silent automatic updates that replace local package files without per-update user confirmation are dangerous because they allow code changes after the initial trust decision. In this skill's context, that is especially risky because the same client also handles network access, file operations, uploads, and potentially credentials, so a compromised or faulty update could materially expand impact.
The changelog states that users in mainland China are routed through a mainland network and may be directed to a different sign-in flow, but there is no indication of explicit user consent or choice. Region-based routing can materially change which infrastructure handles authentication and user content, creating privacy, compliance, and trust risks if users are not informed before data or credentials are sent through alternate networks.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
"icon": "https://beatra.ai/textures/icons/talking-avatar-video-0.1.4.png",
"localized": {
"en": {
"description": "Create a talking avatar from one portrait and a short script or speech track. This AI presenter and digital human video workflow can prepare narration with a selected voice or use a supplied recording, then direct a stable talking-head clip with restrained expression, natural movement, clear delivery, and focused lip-sync review. Use it for AI spokesperson videos, product explainers, training, course lessons, announcements, onboarding, social talking-head content, and photo-to-talking-video messages, with narration-driven facial motion and a focused review of identity, clarity, lip sync, and motion stability.",
"display_name": "Talking Avatar & AI Presenter Video",
"summary": "Turn one portrait and a short script or speech track into a directed talking-avatar video for explainers, announcements, lessons, and product messages.",
"tags": [
The file documents Beatra client auto-update behavior rather than functionality related to creating talking-avatar videos, which indicates the skill bundle includes operational behavior outside its declared purpose. That mismatch is dangerous because unrelated update logic can conceal supply-chain risk, expand the attack surface, and make users grant trust to capabilities they did not expect from this skill.
Enabling automatic installation of updates by default without separate confirmation means local files may be replaced during ordinary use without a deliberate user action. This undermines user control and change awareness, and if the update path is abused it can turn normal skill invocation into an unanticipated software modification event.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
No suspicious patterns detected.