Security audit
Security checks for vulnerabilities and agentic risk
This video skill needs review because it requires unrelated account permissions and its helper does not enforce approval before submitting paid requests.
Before connecting, consider whether you accept a shared Beatra authorization that includes music, speech, voice management, and credit spending. Require approval of each priced video request and upload only the intended product image. Installation analytics are automatic. You can revoke the shared device authorization in the Beatra Console.
scripts/mcp_client.pyPaid generation is executable without the required per-request approval gate
Direct helper invocation can spend the user's Beatra credits before approval of the particular image, settings, price, and number of paid calls.
The supplied chunk implements connection retirement and uninstall maintenance, not image-to-video generation. Although an uninstaller can be ancillary to a larger skill, this code manages shared credentials, remote authorization, and local state—capabilities not represented in the declared image-motion purpose. Its conservative inventory checks and dry-run option limit side effects but do not change that mismatch. This assessment is limited to the supplied chunk; it does not establish what the rest of the package does.
If the reported authorization requests are accurate, music generation, speech generation, and voice-management permissions exceed the needs of this explicitly silent image-to-video workflow. Those permissions unnecessarily increase the consequences of credential compromise or unauthorized tool use; wallet spending itself is expected here and is disclosed through the paid-production approval process.
The reported unrestricted tool dispatcher and arbitrary-file uploader provide capabilities beyond the stated image-only workflow, potentially allowing prompt injection or caller misuse to upload sensitive files or invoke unrelated authenticated operations. Registration is referenced in the document, so telemetry is not necessarily covert, but its reported breadth warrants minimization and clear disclosure; the underlying implementation was not supplied for verification.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
and keeps checking through brief network failures. One run waits up to
about 15 minutes; an approval page stays open for up to an hour;
5. atomically saves the returned Device Token to
`~/.beatra/credentials.json` without printing an HTTP response body;
6. validates the new credential with the same non-billable MCP request and
prints `Beatra is ready` only after it succeeds.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
with _SIGNALS.deferred():
_atomic_json(
credential_path,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _credentials(state_dir: Path) -> tuple[str, str]:
state_dir = state_dir.expanduser()
path = state_dir / "credentials.json"
if not path.is_file():
# Not connected yet (or the file is gone): the caller may still find
# an approval waiting to be collected.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
the file ACL. Never copy the Device Token into conversation context, stdout,
stderr, a command argument, an environment variable, a log, a backup, a diff,
or another file. A completed authorization leaves the token only in
`~/.beatra/credentials.json`.
## Ensure Beatra is ready
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#: is empty — the script never recursively deletes a directory it does not
#: fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
# Updates and security
Since the October 2026 releases, Beatra Skill packages contain no self-updater.
Earlier releases could replace their own files from Beatra's CDN; that code has
been removed. Updates now come only from the store or tool you installed the
Skill from.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
These files are written under `~/.beatra/`. On POSIX that directory is mode
0700. Nothing is written inside the installed Skill directory.
- `credentials.json` (POSIX mode 0600), written by `scripts/authorize.py`: the device credential.
- `installation.json` (POSIX mode 0600), written by `scripts/authorize.py`: the stable installation reference.
- `host.json` (POSIX mode 0600), written by `scripts/authorize.py`: the agent environment, and a device name when one is known.
- `network.json` (POSIX mode 0600), written by `scripts/mcp_client.py`: this computer's network route.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
When `scripts/uninstall.py` decides this is the last Beatra skill on the
computer, it first asks Beatra to revoke the device credential when one is
stored. If Beatra refuses, it changes nothing so the run can be repeated.
Otherwise it unlinks exactly these names in `~/.beatra/`: `credentials.json`,
`installation.json`, `host.json`, `skills.json`, `registrations.json`,
`network.json`, `balance-holds.json`, `pending_authorization.json`, and
`.authorize.lock`. It also unlinks `state.json`, `registration.json`, and
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _existing_credential(state_dir: Path) -> Path | None:
path = state_dir / "credentials.json"
try:
path_stat = os.lstat(path)
if not stat.S_ISREG(path_stat.st_mode):
The authorization scope includes music generation, speech generation, and voice read/write permissions, although the skill promises only single-image video motion. Granting these unrelated capabilities increases the consequences of token theft or agent misuse, potentially allowing unauthorized voice changes and unrelated resource consumption. The shared credential design and rejection of narrower scope sets reinforce this excessive-permission exposure, although this file does not demonstrate actual misuse.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
The instructions direct the agent to infer installation-source metadata from the conversation and record it without notifying the user. This is secondary data collection unrelated to generating a product video, although the fixed, coarse categories limit sensitivity and the supplied document does not establish whether the information is transmitted remotely.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The documented behavior automatically reports a stable installation reference, installation provenance, network-route metadata, and runtime characteristics without describing an opt-in or disable control. Together, these fields enable installation-level tracking beyond what is necessary to generate a product-image video, creating a privacy and data-minimization issue. The explicit disclosure and stated exclusion of prompts, paths, and environment variables reduce concern about malicious intent, but do not establish informed consent or verify the implementation's limits.
The documented update command invokes npx skills without a version pin, allowing npm to fetch and execute a mutable package version when no suitable local installation exists. Although this is an optional maintenance command rather than an MCP server launch, a compromised package release could execute with the caller's permissions; nothing in this file establishes that such a compromise has occurred.
The second npx skills example has the same unpinned package-execution exposure as the first: following it can execute a package version that has not been reviewed. This is a duplicate instance of the same supply-chain weakness, not a separate MCP server vulnerability, and its optional, manual use limits exposure.
The workflow instructs the agent to upload a local seller image for external video processing without warning the user that the image will leave their system. The production approval at lines 67–70 occurs after this upload, so it does not provide advance disclosure of that data transfer.