Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to support the advertised Beatra tax-policy clip workflow, but it also requests broad account powers and silently self-updates by default, so it belongs in Review before installation.
Install only if you are comfortable giving this Beatra package a persistent, shared device authorization with broad media, wallet, task, artifact, and tool access. Consider disabling automatic updates with the documented update command, and revoke the device in the Beatra Console if you no longer want the skill connected.
music:generate is not justified by the described functionality of creating a tax-policy still and spoken brief clip. Unnecessary creative-generation permissions widen what a compromised token can do and indicate poor permission hygiene.
The skill's declared business purpose does not prepare the user for uninstall/removal actions, credential revocation, inspection of installed-skill inventory, or deletion of files under ~/.beatra. Combining content-generation guidance with destructive/local-admin lifecycle operations increases the chance of unintended system changes or credential loss under a misleading trust model.
The skill's declared business purpose does not prepare the user for uninstall/removal actions, credential revocation, inspection of installed-skill inventory, or deletion of files under ~/.beatra. Combining content-generation guidance with destructive/local-admin lifecycle operations increases the chance of unintended system changes or credential loss under a misleading trust model.
The skill's declared business purpose does not prepare the user for uninstall/removal actions, credential revocation, inspection of installed-skill inventory, or deletion of files under ~/.beatra. Combining content-generation guidance with destructive/local-admin lifecycle operations increases the chance of unintended system changes or credential loss under a misleading trust model.
The manifest declares use of a local credential file for device-bearer authentication, giving the skill access to bearer credentials for the Beatra MCP service. In a skill whose core purpose is tax-policy clip generation, credentialed remote access increases the attack surface substantially: if the MCP server, prompts, or tool usage are abused, the skill could perform authenticated actions or expose account-scoped data beyond what users expect.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The requested OAuth scope is far broader than the stated purpose of turning tax-policy content into a still image and short spoken brief. It includes capabilities such as wallet spending, task control, voice management, and music generation, creating unnecessary authority that could be abused if the skill or its token were compromised.
The client contains substantial capabilities unrelated to the advertised tax-policy-brief function, including self-update, installation registration, and local skill inventory tracking. In a skill context, this expands the trust boundary and gives the package the ability to alter itself and persist additional state, which is dangerous if the update or registration path is ever abused or if users were not clearly informed of these behaviors.
The client exposes generic remote MCP tool listing and invocation rather than a narrowly scoped tax-policy workflow. That means the package can act as a broad remote command gateway to whatever tools the backend makes available, which is a major capability mismatch for a supposedly specialized media-generation skill and increases the blast radius of backend misuse or compromise.
The skill supports self-modification through an update command and related update mechanisms elsewhere in the file. Self-modifying behavior is especially sensitive in a narrowly described skill because it allows future code changes to be introduced through network-delivered artifacts, widening the attack surface beyond the static package the user initially trusted.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool/permission scope even though it instructs use of shell, network, file access, and likely environment-backed auth flows. That creates unnecessary ambient authority: a host may grant broader capabilities than users expect, increasing the blast radius if the skill is misused or modified.
The skill states that the bundled client silently auto-installs newer releases without separate confirmation. Even with signature and manifest verification, silent code replacement expands supply-chain risk and changes runtime behavior after trust was initially granted, especially when the warning is not surfaced near execution steps.
The changelog states that users in mainland China are routed through a specific mainland network, with an alternative sign-in path only if needed. This is a natural-language locale policy constraint that appears to impose region-specific behavior without clearly presenting it as an explicit user choice or documented compliance requirement.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
The document states that one authorization grants access across image, video, music, speech, upload, model, and task tools, which is far broader than the advertised tax-policy brief clip purpose. This creates unjustified capability expansion and increases the chance that the skill can be used as a general-purpose remote service broker rather than a narrowly scoped media workflow.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The bundled MCP client documentation explicitly supports remote tool discovery and arbitrary tool execution via tools/list and tools/call, exposing a generic execution surface instead of a fixed tax-policy clip pipeline. In a skill context, this materially increases attack surface because the agent can enumerate and invoke remote capabilities outside the user's expected task boundaries.