Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches a talking-pet video workflow, but it asks for broader Beatra account permissions and enables silent self-updates by default.
Install only if you are comfortable granting this Beatra package a shared full-scope device token, paid generation authority, and default silent package updates. Consider disabling auto-updates with `python3 scripts/mcp_client.py update --auto off`, review the Beatra approval page scopes carefully, and avoid using it from an account where unrelated Beatra voice, music, image, wallet, or task access would be unacceptable.
The scope set includes music:generate, voices:read, and voices:write, which are not justified by the described talking-pet workflow. Unnecessary creative and voice-management privileges expand the attack surface and could let the skill access or alter user voice assets or generate unrelated content without clear consent.
The skill references uninstall, token revocation, local credential/config deletion, and shared connection lifecycle management even though its stated purpose is pet-video creation. Those administrative actions are sensitive and can affect other installed skills or shared account state, so hiding them inside a benign-seeming skill description creates substantial trust and safety concerns.
The skill references uninstall, token revocation, local credential/config deletion, and shared connection lifecycle management even though its stated purpose is pet-video creation. Those administrative actions are sensitive and can affect other installed skills or shared account state, so hiding them inside a benign-seeming skill description creates substantial trust and safety concerns.
The skill references uninstall, token revocation, local credential/config deletion, and shared connection lifecycle management even though its stated purpose is pet-video creation. Those administrative actions are sensitive and can affect other installed skills or shared account state, so hiding them inside a benign-seeming skill description creates substantial trust and safety concerns.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The helper requests a very broad OAuth scope set including images, videos, music, speech, voices, artifacts, tasks, and wallet permissions, while the skill is presented as a talking-pet video generator from a pet photo and short audio/message. Over-scoped tokens violate least privilege and materially increase blast radius if the token is misused, stolen, or the skill behaves unexpectedly.
The scope set includes music:generate, voices:read, and voices:write, which are not justified by the described talking-pet workflow. Unnecessary creative and voice-management privileges expand the attack surface and could let the skill access or alter user voice assets or generate unrelated content without clear consent.
This client includes broad self-update, installation tracking, route management, and registration behavior that materially exceeds the stated 'talking pet video' purpose. In a skill context, code that can rewrite its own installation and perform unrelated lifecycle/telemetry operations increases supply-chain risk and creates a larger trusted computing base than users would reasonably expect.
The skill exposes self-update functionality that can replace files within its own installation tree. In the context of a talking-pet-video skill, self-modifying code is especially risky because it is unrelated to the advertised task and creates a supply-chain and persistence mechanism inside a content-generation tool.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The function reads an access token from ~/.beatra/credentials.json and uses it to authorize a revocation request. Accessing and using a shared bearer token is a credential-handling capability with high privilege; in the context of a pet-video skill, this is unnecessary and increases the blast radius if the package is modified or abused.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool/permission scope even though it instructs use of shell, network, file access, and environment-sensitive operations through a bundled client. That increases the attack surface and makes it harder for a host to enforce least privilege or for users to understand what capabilities the skill may exercise.
The manifest description lists very broad use cases such as "pet greeting," "pet reaction," "pet story," and "pet message video" without defining explicit trigger phrases or exclusion conditions. In a markdown/manifest context, this can make activation scope unclear and increase the chance of unintended invocation from ordinary creative requests involving pets.
The skill describes silent automatic updates that can download, verify, and replace package-owned files without separate confirmation during ordinary command execution. Even with integrity checks, silent code modification is a high-risk behavior because it changes the local execution surface unexpectedly and can bypass normal review or approval expectations.
The manifest states that users in mainland China are routed through a different network and may use an international approval site, but it does not describe consent, security guarantees, or why this routing is required. Region-based traffic handling without transparent opt-in can expose users to unexpected data transfer paths, regulatory issues, or credential interception through alternate login flows.
The document states that the client silently checks for and automatically installs newer releases by default before normal commands, without separate confirmation. Even with integrity checks and fixed update sources, silent default file replacement expands the trust boundary and can surprise users, creating supply-chain and operational risk if the update channel, signing process, or publisher account is ever compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
No suspicious patterns detected.