Security audit
Security checks for vulnerabilities and agentic risk
The core voiceover workflow is coherent, but the skill stores a broad Beatra device token and silently self-updates, so users should review it before installing.
Review this before installing. It is suitable only if you are comfortable connecting a Beatra account with a shared full-scope device token, allowing voice sample uploads after consent, and accepting default silent package updates. Disable automatic updates if you do not want local package files replaced automatically, and only use voice cloning for your own voice or a speaker who explicitly authorized it.
The same package also documents uninstall behavior that deletes local auth/state files and revokes authorization remotely, which is far outside the advertised voice generation role. Hidden lifecycle-management behavior is risky because a user invoking a content skill would not reasonably expect local credential/state deletion and account-connected revocation actions to be bundled with it.
The same package also documents uninstall behavior that deletes local auth/state files and revokes authorization remotely, which is far outside the advertised voice generation role. Hidden lifecycle-management behavior is risky because a user invoking a content skill would not reasonably expect local credential/state deletion and account-connected revocation actions to be bundled with it.
The same package also documents uninstall behavior that deletes local auth/state files and revokes authorization remotely, which is far outside the advertised voice generation role. Hidden lifecycle-management behavior is risky because a user invoking a content skill would not reasonably expect local credential/state deletion and account-connected revocation actions to be bundled with it.
The skill states that routine commands can automatically download, install, and replace package files without separate confirmation. That is a high-risk capability because any compromise in update infrastructure, signing policy, or package ownership boundaries could turn normal skill usage into a code-delivery mechanism on the local system.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
duration as a review target, not a guarantee. Preserve supplied claims,
pronunciations, names, ordering, and target-language text.
For cloning, the one non-negotiable first fact is consent. A clear statement
that it is the user's own voice is enough; otherwise obtain a clear statement
that the speaker authorized cloning. Do not turn that confirmation into
paperwork. Stop before upload while it is missing.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
duration as a review target, not a guarantee. Preserve supplied claims,
pronunciations, names, ordering, and target-language text.
For cloning, the one non-negotiable first fact is consent. A clear statement
that it is the user's own voice is enough; otherwise obtain a clear statement
that the speaker authorized cloning. Do not turn that confirmation into
paperwork. Stop before upload while it is missing.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The authorization scope requests a very broad set of capabilities, including images, videos, music, wallet spending, and task control, even though the skill is described as a voiceover and narration tool. This violates least privilege and means any stolen token or compromised skill execution could be abused far beyond speech generation, materially increasing blast radius.
The scope includes image, video, and music generation capabilities that do not match the declared voiceover/narration use case. That overbroad token could be repurposed to access unrelated generation features, increasing both abuse potential and user-consent mismatch.
The scope includes image, video, and music generation capabilities that do not match the declared voiceover/narration use case. That overbroad token could be repurposed to access unrelated generation features, increasing both abuse potential and user-consent mismatch.
The presence of a built-in self-update mechanism means the skill can modify its own installed code on disk, which is a powerful and risky capability for an end-user-facing creative tool. In this context, self-modification is more dangerous because the manifest describes voiceover functionality, not a general software management agent, so users may not reasonably expect ongoing code replacement behavior.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool scope while instructing use of shell, network, file upload, and local state operations through a bundled client. That creates unnecessary privilege ambiguity and increases the chance the runtime grants broader capabilities than users expect, especially given the skill also references local file handling and persistent credential storage.
The skill documentation includes self-updating package behavior unrelated to generating voice output. Even with integrity checks described, embedding updater behavior in a content-production skill creates a supply-chain risk and violates user expectations about what ordinary use of the skill may change locally.
The skill enables automatic updates during normal operation without clearly warning in the main description that using the skill may modify local package files. This undermines informed consent and can cause users to grant access under a false assumption that the skill is limited to remote voice synthesis tasks.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
"icon": "https://beatra.ai/textures/icons/voiceover-narration-studio-0.1.1.png",
"localized": {
"en": {
"description": "Use Voiceover & Narration Studio as an AI voice generator, text-to-speech workspace, and AI voiceover generator. Choose from the current voice library, turn scripts into ready-to-edit AI narration and voiceover, or create and reuse a custom brand voice through voice cloning. It supports short-video voiceover, script-to-voiceover, course narration, ordered audiobook narration, supplied multilingual text to speech, Cantonese text to speech, and recurring brand audio, with current price estimates, clear output planning, and delivery organized by chapter, language, and use case.",
"display_name": "Voiceover & Narration Studio",
"summary": "Choose or reuse a voice, turn scripts into ready-to-edit narration, plan ordered long-form or multilingual audio, and create a reusable custom voice.",
"tags": [
The manifest advertises voice cloning and reusable brand voices without any visible warning about consent, ownership, or biometric/privacy implications. In this context, users may provide or clone voices without understanding that voice data is sensitive and may require explicit authorization, creating risk of impersonation, privacy abuse, or policy violations.
No suspicious patterns detected.