Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Beatra video-generation skill, but it needs Review because it stores a broad shared Beatra token and silently replaces its own package files by default.
Review this before installing if you are uncomfortable with a Beatra account token that can spend credits and access multiple Beatra media/tool capabilities, not only video. The skill asks for explicit confirmation before paid video calls, but auto-update is on by default; disable it after install with `python3 scripts/mcp_client.py update --auto off` if you require manual change control. Only upload media you intend to send to Beatra, and revoke the device from the Beatra Console if you no longer trust the installation.
The same video-production skill also contains uninstall and deauthorization behavior that reads/modifies local state under ~/.beatra and contacts remote services to revoke tokens. Even if legitimate, bundling destructive lifecycle operations into a creative skill increases the risk of accidental credential removal, state tampering, or misuse outside the user's expectations.
The same video-production skill also contains uninstall and deauthorization behavior that reads/modifies local state under ~/.beatra and contacts remote services to revoke tokens. Even if legitimate, bundling destructive lifecycle operations into a creative skill increases the risk of accidental credential removal, state tampering, or misuse outside the user's expectations.
The same video-production skill also contains uninstall and deauthorization behavior that reads/modifies local state under ~/.beatra and contacts remote services to revoke tokens. Even if legitimate, bundling destructive lifecycle operations into a creative skill increases the risk of accidental credential removal, state tampering, or misuse outside the user's expectations.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization flow requests a very broad OAuth scope set including images, music, speech, voices, artifacts/tasks, and notably wallet:spend, which exceeds what a video-generation skill should minimally need. If the token is compromised or the service/skill is abused, this overprivileged credential could be used for unrelated content generation, data access, task control, or account spending beyond the user's expected consent.
Exposing a self-update capability in the client means the skill can intentionally replace its own package files and alter future behavior after installation. In the context of a video-generation skill, self-modification is especially risky because it is orthogonal to the advertised purpose and creates a durable post-install code execution pathway if the update channel or upstream is compromised.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope while instructing use of shell, local file access, networked uploads, and remote tool invocation. That combination gives the agent broad ambient authority without a clear least-privilege boundary, increasing the chance of unintended file access, data exfiltration, or unsafe command execution during normal use.
The skill includes a self-updating mechanism that can replace package-owned files, which is unrelated to the core video-generation task and materially increases supply-chain risk. Even with integrity checks described in the text, automatic code replacement creates a high-impact trust boundary because future behavior can change without per-use review.
The skill states that newer releases install without separate confirmation, but this system-changing behavior is not prominently disclosed in the top-level description users rely on when deciding whether to enable the skill. Insufficient disclosure undermines informed consent and can lead to silent local file replacement in environments where change control matters.
The changelog states that users in mainland China are routed through a specific mainland network and, alternatively, an approval page on an international site. This introduces region-specific traffic handling and sign-in flow changes without any visible user consent, security rationale, or explanation of privacy implications, which can affect where credentials and metadata are sent.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
"icon": "https://beatra.ai/textures/icons/video-generation-studio-0.1.1.png",
"localized": {
"en": {
"description": "Plan and create short AI videos from a written shot, a supplied image, exact first and last frames, multimodal references, or existing footage. Video Generation Studio supports text-to-video, image-to-video, reference-guided generation, AI video editing, and AI video extension for product videos, ad creative, social clips, b-roll, transitions, reveals, and cinematic concepts. Review each delivered clip for action, subject stability, camera, continuity, audio when requested or returned, and destination fit, then choose the smallest useful edit, extension, or new render.",
"display_name": "Video Generation Studio",
"summary": "Generate, animate, edit, and extend short AI videos for ads, product stories, social posts, b-roll, transitions, and cinematic concepts.",
"tags": [
The document states that the client silently checks for updates and automatically installs newer releases by default before ordinary commands, without separate confirmation. Even with integrity checks and rollback, unattended code replacement changes the local execution environment without an explicit per-update user decision, increasing supply-chain and operational risk if the update channel, signing process, or publisher account is ever compromised.
The document specifies that updates are tied to the package's embedded channel and locale, including alternate mainland China endpoints, but does not indicate any user choice or opt-in for locale selection. This may violate language or locale policy because the client behavior is constrained by a fixed locale setting rather than an explicit user preference.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The code records a device-wide ~/.beatra/skills.json inventory of installed skills and their install paths, which is unrelated to core video generation and creates cross-skill tracking metadata. Even though it is local-only and best-effort, it expands collected data about the user's environment and installed tooling, which could expose privacy-sensitive information or facilitate later targeting if read by other local processes.
No suspicious patterns detected.