Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a real Beatra video retouch integration, but it asks for broad shared account authority and can silently update its own installed files.
Install only if you are comfortable granting this Beatra package a shared full-scope Beatra device token, allowing it to store state under ~/.beatra, register coarse installation/runtime facts, and silently update its package files by default. Consider disabling auto-updates with the documented update --auto off command and revoking the Beatra device connection from the Beatra Console when no longer needed.
Broad tasks and artifact read/write/cancel permissions are not clearly justified by the skill's described retouch-only purpose. These permissions could expose or manipulate unrelated user jobs and stored outputs, increasing privacy and integrity risk beyond the intended workflow.
The skill presents itself as a video retouch tool but also references uninstallation, credential/state access under ~/.beatra, and revocation/network cleanup actions. Undisclosed local state access and deletion are risky because they can affect user credentials, installation integrity, or other shared skills while appearing unrelated to the advertised task.
The skill presents itself as a video retouch tool but also references uninstallation, credential/state access under ~/.beatra, and revocation/network cleanup actions. Undisclosed local state access and deletion are risky because they can affect user credentials, installation integrity, or other shared skills while appearing unrelated to the advertised task.
The skill presents itself as a video retouch tool but also references uninstallation, credential/state access under ~/.beatra, and revocation/network cleanup actions. Undisclosed local state access and deletion are risky because they can affect user credentials, installation integrity, or other shared skills while appearing unrelated to the advertised task.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
The file documents an automatic installation-registration call that collects installation metadata, network-route information, install source, and coarse runtime facts unrelated to the advertised function of a focused local video-retouch skill. Even if described as non-billable and best-effort, this is still undisclosed telemetry behavior in a skill whose manifest suggests local media processing, creating a meaningful privacy and trust violation and expanding the attack surface for tracking.
The documented telemetry captures persistent installation and environment attributes that can support cross-session tracking and operational profiling, yet this capability is not justified by the stated video-retouch purpose. In skill context, this mismatch makes the behavior more dangerous because users would reasonably expect media transformation, not background reporting about system and installation characteristics.
The document instructs all skill packages to share a single full-scope device token from a fixed user path, which expands the trust boundary across packages and increases the blast radius of any compromised or malicious skill. Even though it says not to print or move the token, normalizing broad credential reuse in package documentation creates a real credential-access risk because any package code with local file access can target that path and abuse the token for unauthorized MCP/API actions.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization scope is far broader than the stated purpose of a focused video realism retouch skill. Requesting images, videos, music, speech, voices, task control, artifact access, and spending-related permissions violates least privilege and means compromise or misuse of this skill could grant access well beyond video cleanup.
Broad tasks and artifact read/write/cancel permissions are not clearly justified by the skill's described retouch-only purpose. These permissions could expose or manipulate unrelated user jobs and stored outputs, increasing privacy and integrity risk beyond the intended workflow.
The client contains broad self-update, installation mutation, registration, routing, provenance tracking, and local inventory behavior that is far beyond a narrowly scoped video-retouch skill. Even though some integrity checks are present, this materially expands the trust boundary: a media-editing skill can rewrite its own installed files and maintain persistent system state, creating a powerful supply-chain and post-installation execution surface.
Exposing self-update/self-modification capability in a skill means the installed codebase can be changed from within the client itself, which is a high-risk capability unrelated to basic video retouching. Even with checksum and manifest validation, this creates a remote code lifecycle channel that substantially increases supply-chain risk and makes the skill more dangerous than its stated function suggests.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The function reads ~/.beatra/credentials.json to obtain an access token, then uses that token in the uninstall path to attempt remote revocation. This is credential access by a skill-specific script, and in a video-retouch context it is over-privileged because the skill should not need direct bearer-token handling to perform its advertised function.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool restrictions while the content directs use of shell, filesystem, network, and credential-related capabilities. That combination increases the blast radius of any prompt injection, implementation bug, or hidden helper behavior because the agent is not constrained to the minimum permissions needed for a narrow video-retouch task.
The skill includes an automatic self-update mechanism that can silently replace installed package files during ordinary command execution. Even with stated integrity checks, this introduces supply-chain and integrity risk, especially for a skill whose primary purpose is supposed to be focused video retouching rather than package management.
The update section describes automatic installation of newer versions without an equally prominent upfront warning that local files may be modified as part of routine use. Users may unknowingly run a skill that changes its own code or assets, undermining informed consent and making incident review harder.
The changelog states that users in mainland China are routed through a specific mainland network, with an alternative international sign-in path only if another method is needed. This imposes region-specific behavior in natural language without clear opt-in framing or a documented policy justification, which can violate language/locale policy expectations.
The document states that update checks are silent and enabled by default, and that higher versions are installed automatically without separate confirmation. Even with strong integrity and rollback controls described elsewhere in the file, silent default auto-replacement of local package files can surprise users, widen the blast radius of any upstream compromise or signing/distribution mistake, and reduce meaningful user consent for code changes.
No suspicious patterns detected.