Security audit
Security checks for vulnerabilities and agentic risk
This video-making skill is not evidently malicious, but it requests broad Beatra account powers and can silently replace its own files, so it needs user review before installation.
Install only if you are comfortable giving Beatra a shared device credential with broad media, task, artifact, and wallet-related powers, and if you accept default silent package updates. Consider disabling auto-updates with the documented command and reviewing Beatra account/device revocation controls before using paid generation.
The skill presents as a content-creation tool but also includes uninstall, revocation, installed-skill inspection, and deletion/modification of local Beatra state under the user's home directory. Such administrative and destructive behaviors are outside user expectations for a media skill and could be abused to disrupt other skills, remove credentials, or tamper with shared state.
The skill presents as a content-creation tool but also includes uninstall, revocation, installed-skill inspection, and deletion/modification of local Beatra state under the user's home directory. Such administrative and destructive behaviors are outside user expectations for a media skill and could be abused to disrupt other skills, remove credentials, or tamper with shared state.
The skill presents as a content-creation tool but also includes uninstall, revocation, installed-skill inspection, and deletion/modification of local Beatra state under the user's home directory. Such administrative and destructive behaviors are outside user expectations for a media skill and could be abused to disrupt other skills, remove credentials, or tamper with shared state.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization scope requests a very broad set of privileges, including artifacts, image/video/music/speech generation, voice management, wallet spending, task control, and artifact/task read access, which substantially exceeds the stated purpose of creating Taobao/Tmall product videos. Overbroad OAuth scopes violate least-privilege and increase blast radius if the token is misused, leaked, or the skill behaves unexpectedly.
The requested music:generate capability is not clearly supported by the skill description, which focuses on product main-image videos from photos, selling points, and brand references. Even if music could be useful, requesting it without clear disclosure and necessity is an over-privilege issue that broadens possible misuse of the credential.
The skill includes a self-modification/update capability, which is inherently high risk because it allows the codebase to replace its own installed files. In a skill advertised for video creation, this is especially concerning because the capability is orthogonal to the stated function and increases the blast radius of any upstream compromise or trust failure.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill exposes broad operational capabilities through shell execution, network access, file reads/writes, and environment access, yet does not declare a restrictive tool scope. That increases the blast radius of any prompt injection, implementation bug, or malicious package behavior because the host cannot enforce least privilege at the skill boundary.
The skill includes a self-updating mechanism that downloads and replaces local package files, which is unrelated to its stated video-making purpose. Even with claimed verification, self-update materially expands the attack surface by introducing supply-chain risk and code changes outside the host's normal review and permission expectations.
Automatic file-replacing updates are enabled by default, but this behavior is not prominently disclosed in the skill description users see before trust decisions are made. Silent background code replacement reduces informed consent and increases the risk that a previously reviewed skill changes behavior after installation.
The changelog states that users in mainland China are routed through a specific mainland network by default, with an alternative sign-in path only mentioned conditionally. Region-specific routing can change trust boundaries, data handling, and censorship/compliance exposure without clear user consent or justification, which is a real security and privacy concern.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
"icon": "https://beatra.ai/textures/icons/taobao-main-video-maker-0.1.1.png",
"localized": {
"en": {
"description": "Create a Taobao product main-image video or Tmall product main-image video from product photos, selling points, and brand references. This AI product video maker builds a product-led opening, detail or use moment, and clean finish for Taobao product listings, Tmall product pages, ecommerce product listing videos, new-product launches, and seasonal campaigns.",
"display_name": "Taobao Product Main Image Video Maker",
"summary": "Turn product photos and selling points into a concise Taobao or Tmall product main-image video with a clear opening, product details, and a clean finish.",
"tags": [
The document states that the client silently checks for updates and installs newer versions automatically without separate confirmation. Even with integrity checks and pinned update sources, automatic file replacement by default increases supply-chain and change-management risk because code on the user's system can change without an explicit approval step at update time.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The document describes automatic installation registration and telemetry unrelated to the skill's stated purpose of generating Taobao/Tmall product videos. Even if framed as limited and non-blocking, it discloses host, network-route, install-source, locale, and runtime metadata to a remote service, creating an unnecessary privacy and supply-chain tracking channel that users may not expect from this skill.
No suspicious patterns detected.