Security audit
Security checks for vulnerabilities and agentic risk
This voice-pack skill is disclosed and mostly coherent, but it grants and persists broad Beatra account authority beyond a narrow visitor-desk audio workflow.
Review this before installing if you are not already comfortable with Beatra’s shared device-token model. Installing connects a local agent to Beatra with broad media-generation, wallet spending, task, artifact, and voice permissions, stores a bearer token under ~/.beatra, and enables silent verified package updates by default. Disable automatic updates with the documented update command if you require review before code changes.
The script also requests task-management and voice-administration capabilities, including tasks:read, tasks:cancel, voices:read, and voices:write, none of which are justified by a simple voice-pack generation workflow. These permissions could expose other user jobs, interfere with unrelated work, or modify voice assets outside this skill's intended boundaries.
The documented behavior includes uninstalling the package, modifying ~/.beatra state, reading credential/inventory files, revoking tokens, and managing shared connection lifecycle—actions unrelated to generating reception audio. Undisclosed uninstall and teardown capabilities can be abused to disrupt service, remove local state, or tamper with shared authentication context under the guise of a benign content-production skill.
The documented behavior includes uninstalling the package, modifying ~/.beatra state, reading credential/inventory files, revoking tokens, and managing shared connection lifecycle—actions unrelated to generating reception audio. Undisclosed uninstall and teardown capabilities can be abused to disrupt service, remove local state, or tamper with shared authentication context under the guise of a benign content-production skill.
The documented behavior includes uninstalling the package, modifying ~/.beatra state, reading credential/inventory files, revoking tokens, and managing shared connection lifecycle—actions unrelated to generating reception audio. Undisclosed uninstall and teardown capabilities can be abused to disrupt service, remove local state, or tamper with shared authentication context under the guise of a benign content-production skill.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization scope is dramatically broader than the stated purpose of generating visitor reception voice clips. It provisions capabilities for artifacts, images, videos, music, speech, voices administration, wallet spending, and task operations, violating least privilege and enabling account actions far beyond what this skill should need.
The script also requests task-management and voice-administration capabilities, including tasks:read, tasks:cancel, voices:read, and voices:write, none of which are justified by a simple voice-pack generation workflow. These permissions could expose other user jobs, interfere with unrelated work, or modify voice assets outside this skill's intended boundaries.
The script also requests task-management and voice-administration capabilities, including tasks:read, tasks:cancel, voices:read, and voices:write, none of which are justified by a simple voice-pack generation workflow. These permissions could expose other user jobs, interfere with unrelated work, or modify voice assets outside this skill's intended boundaries.
This code persists a long-lived bearer access token to credentials.json on disk. Although it applies restrictive filesystem permissions, local plaintext token storage increases the blast radius of host compromise, backup leakage, or accidental file exposure—especially given the excessively broad scopes requested by this skill.
scope = _required_string(polled, "scope")
if set(scope.split()) != set(SCOPE.split()):
raise RuntimeError("Beatra authorization returned an unsupported scope")
credential_path = state_dir / "credentials.json"
with _SIGNALS.deferred():
_atomic_json(
credential_path,
The skill contains a self-update mechanism that downloads manifests and archives from the network and replaces installed package files on disk. Even with checksum and path checks, embedding self-modifying behavior in a voice-pack skill is a risky hidden capability because it allows the package's behavior to change after installation in ways not implied by the manifest description.
The file exposes a general-purpose networked MCP client with generic tools/list, tools/call, and upload operations, which is far broader than the stated visitor voice-clip purpose. In the context of an agent skill, this materially expands the attack surface and can enable remote actions, data transmission, and capability pivoting unrelated to the advertised function.
The command path accepts a tool name and arguments, then forwards them as a generic tools/call request to the remote MCP endpoint. For a visitor reception voice-pack skill, arbitrary remote tool invocation is unjustified and dangerous because it can be used as a capability trampoline to invoke unrelated server-side actions under the skill's authorization context.
The CLI explicitly supports package self-updates, and elsewhere in the file that path downloads and replaces code on disk. In the context of a narrowly described voice skill, self-modification is a dangerous hidden capability because it can alter future behavior of the installed package and undermine the user's trust in what was originally installed.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The uninstall script is able to revoke a shared Beatra device credential and participate in removing global state under ~/.beatra, which affects resources outside this skill's narrow stated purpose of generating visitor reception voice clips. Even though the code tries to do this cautiously, the capability itself is over-privileged for the declared functionality and could disrupt other installed skills or the user's wider Beatra environment if invoked unexpectedly or modified.
The script defines deletion of multiple files in the shared ~/.beatra state directory, including credentials, inventory, registration, and host state. Although it attempts to do so only when no other skills remain, this still grants a voice-pack skill authority to erase shared platform state beyond its own boundary, which can break unrelated skills and undermine least-privilege expectations.
Including credentials.json in the set of removable shared state shows this skill is designed to handle platform credential material directly. In the context of a visitor voice-pack skill, direct access to shared credentials is unjustified and dangerous because any bug, tampering, or repurposing of the script could cause credential destruction or misuse affecting all skills on the device.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
This code can make outbound requests to Beatra authorization infrastructure and submit a bearer token revocation request, which is unrelated to producing voice clips. A skill with network-capable token revocation logic materially increases the blast radius of compromise or misuse by allowing the skill to disable device authorization and interfere with other skills sharing that credential.
The _device_token function reads the shared access token from ~/.beatra/credentials.json so the skill can use it in an Authorization header for revocation. Reading raw bearer tokens inside a skill package is excessive for the declared functionality and creates an unnecessary credential-access path that could be abused to revoke, exfiltrate, or otherwise misuse shared authorization.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool scope while its documented workflow relies on powerful capabilities including shell, file access, network access, and environment interaction. That creates an unnecessarily broad trust boundary, making it easier for the skill or bundled components to access local state, invoke external services, and perform actions beyond the user-visible task.