Security audit
Security checks for vulnerabilities and agentic risk
The skill’s media workflow is coherent, but it uses a shared high-privilege Beatra credential and silently updates its own package files by default, so users should review it carefully before installing.
Install only if you trust Beatra with a shared device login that can spend credits and use multiple media-generation capabilities. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, review Beatra account and wallet permissions, and be aware that pasted social links, comments/transcripts, uploaded media, and generated artifacts are handled through Beatra’s remote service.
The skill includes uninstall logic, reads and mutates local state files, inspects installed-skill inventory, revokes tokens, and deletes local credential/install files even though its declared purpose is media analysis and remake. Embedding destructive account/state-management operations inside an unrelated creative workflow increases the chance of unintended credential loss or local state tampering.
The skill includes uninstall logic, reads and mutates local state files, inspects installed-skill inventory, revokes tokens, and deletes local credential/install files even though its declared purpose is media analysis and remake. Embedding destructive account/state-management operations inside an unrelated creative workflow increases the chance of unintended credential loss or local state tampering.
The skill includes uninstall logic, reads and mutates local state files, inspects installed-skill inventory, revokes tokens, and deletes local credential/install files even though its declared purpose is media analysis and remake. Embedding destructive account/state-management operations inside an unrelated creative workflow increases the chance of unintended credential loss or local state tampering.
The credential_file field points to a local credentials.json file, indicating the skill can rely on locally stored bearer credentials to access the remote MCP service. In this context, that is security-sensitive because the skill's purpose involves fetching external content and could leverage the user's authenticated session without granular visibility or per-action consent.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The helper requests a very broad OAuth scope set, including wallet:spend plus image/video/music/speech generation and task/artifact privileges that exceed the stated purpose of analyzing and remaking viral videos. If the skill or any downstream component is compromised or abused, the granted token could be used for unauthorized spending or broad account actions far beyond what the user expected to authorize.
The explicit self-update capability gives the package a built-in mechanism to modify its own code and installation state. While framed as maintenance, self-modifying behavior is high-risk in agent skills because it changes the trusted local codebase post-install and can be abused through update-channel compromise or unexpected operational paths.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope while instructing use of shell, network, file read/write, and environment-capable operations. That overbroad undeclared capability increases the blast radius of the skill and prevents meaningful consent or sandboxing, especially because it also performs package updates, credential handling, and remote calls.
The example invocation hard-codes {"language":"zh-CN"} for beatra.voices.list, which indicates a fixed language/locale choice. Under the policy, forcing a locale without user opt-in is a natural-language policy issue unless the constraint is clearly justified or optional.
The skill includes self-updating package management unrelated to the advertised teardown/remake purpose. Any mechanism that downloads and replaces package files at runtime expands trust to remote update infrastructure and can be abused for supply-chain compromise, especially in a skill that already has shell, file, and network reach.
The manifest presents a media workflow, but the documentation later introduces silent automatic code replacement. That mismatch undermines user trust and informed consent, because code modification is a materially different risk than analyzing or generating media artifacts.
Automatic self-update is a system-modifying action, and the warning is buried late in the document rather than prominently disclosed in the skill description. Poor disclosure increases the likelihood that users authorize the skill without understanding that it may replace local code automatically.
The manifest advertises that the skill will read captions, authors, visible metrics, comments, and YouTube transcripts from third-party links, but it does not disclose privacy, consent, or data-handling implications to the user. That creates a real security/privacy issue because users may provide links or content without understanding that external content and associated metadata will be fetched and processed.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
"viral video teardown",
"short video remake",
"viral video breakdown",
"recreate a viral video",
"competitor video analysis",
"video hook analysis",
"short form video script generator",
The manifest explicitly references a local credential file used for device-bearer authentication, but there is no user-facing warning that the skill depends on local credentials or may access authenticated resources through them. This is dangerous because it can cause users to unknowingly grant the skill access to an existing authenticated Beatra session and any connected account capabilities.
The document states that update checks are silent, enabled by default, and that higher versions are installed automatically without separate confirmation. Even with strong integrity checks and rollback protections, silently replacing local files can violate user expectations, create change-management risk, and increase the blast radius if the official update channel or signing/checksum pipeline is ever compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
No suspicious patterns detected.