Security audit
Security checks across malware telemetry and agentic risk
The skill is mainly a TikTok product-video planning helper, but it also carries broad Beatra account authority, local credential handling, arbitrary remote tool calls, file upload, telemetry, and silent self-updates that are not well scoped to planning.
Review this carefully before installing. Use it only if you are comfortable granting a Beatra device token with broad account capabilities, allowing a local ~/.beatra credential store, and accepting default silent updates. Consider disabling automatic updates with the documented command and avoid using the generic call/upload commands unless you intentionally want remote Beatra tool access.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
_atomic_json(
credential_path,
{def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",VirusTotal findings are pending for this skill version.
No suspicious patterns detected.