Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it claims, but it uses a broad persistent Beatra device token and silently self-updates package code by default, which deserves careful review before installation.
Install only if you are comfortable giving Beatra a persistent shared device authorization, using paid Beatra media tools through the bundled client, allowing limited installation registration telemetry, and accepting silent verified package updates by default. Consider running the documented auto-update disable command before use in stricter environments.
The inclusion of tasks:cancel is not justified by the described one-photo, one-clip workflow and could let the skill interfere with other user operations. In a shared task environment, misuse of this scope could disrupt unrelated jobs and create denial-of-service or workflow tampering effects.
The skill claims to create talking clips, yet referenced behavior includes uninstall/cleanup logic, deletion of local state, inspection of shared credentials/inventory, and token revocation. That is a severe description-behavior mismatch because destructive local actions and credential handling are unrelated to the core media task and could be triggered under the guise of normal usage.
The skill claims to create talking clips, yet referenced behavior includes uninstall/cleanup logic, deletion of local state, inspection of shared credentials/inventory, and token revocation. That is a severe description-behavior mismatch because destructive local actions and credential handling are unrelated to the core media task and could be triggered under the guise of normal usage.
The skill claims to create talking clips, yet referenced behavior includes uninstall/cleanup logic, deletion of local state, inspection of shared credentials/inventory, and token revocation. That is a severe description-behavior mismatch because destructive local actions and credential handling are unrelated to the core media task and could be triggered under the guise of normal usage.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- `~/.beatra/installation.json` contains one stable, non-secret installation
reference.
- `~/.beatra/credentials.json` contains the single Device Token.
On POSIX systems the directory must be mode `0700` and both files mode `0600`.
On Windows the current user must be the only principal granted access through
The documentation states that all packages share a single full-scope device token from ~/.beatra/credentials.json, creating a broad trust boundary and a high-value secret available to any package code that can read the file. In the context of agent skills, this is dangerous because a compromised or malicious skill could reuse that token to access MCP resources across packages, leading to cross-skill account abuse and unauthorized actions.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The OAuth scope string requests a very broad set of capabilities, including artifacts, images, videos, music, speech, voice administration, wallet spending, and task operations, which significantly exceeds the stated purpose of generating wealth-product talking clips from a factsheet and stills. If the skill or any downstream component is compromised or misused, the resulting token grants far more authority than necessary, increasing blast radius and violating least-privilege.
The skill exposes a self-update mechanism that downloads and installs new package contents into its own installation directory. Even with checksum validation, self-modifying behavior is high risk in an agent skill because it can materially change code after review, undermining static vetting and expanding the consequences of any upstream compromise or signing/distribution failure.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The presence of credentials.json in the managed shared state indicates this skill’s uninstall path is designed to operate on credential-bearing files outside its own package scope. Access to shared credential storage is sensitive because any bug, misuse, or later code change in this flow could expose, misuse, or destroy credentials relied on by other skills.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
The _device_token function reads an access token from ~/.beatra/credentials.json and returns it for use in an Authorization header during revocation. Reading bearer tokens directly from disk inside a content-generation skill is highly sensitive overreach: if the script is modified, invoked unexpectedly, or chained with other flaws, it enables direct use of shared credentials against remote services.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill exposes broad effective capabilities (environment, filesystem, network, shell) without declaring an explicit tool scope or least-privilege boundary. That makes it harder for the host to constrain execution and increases the blast radius if the skill is misused, compromised, or its bundled client behaves unexpectedly.
The skill includes self-updating package installation and file replacement behavior that is not necessary for generating talking clips. Any self-modifying mechanism increases supply-chain risk, especially when paired with network access and shell execution, because future behavior can change after review.
The manifest and top-level description advertise a clip-generation studio, but the documented runtime also performs software update, download, verification, and file replacement. Even if verification exists, the undisclosed system-modifying behavior materially changes the trust model and exceeds what a user would reasonably expect from a content skill.
Automatic updates are described as installing without separate confirmation, but the main execution guidance does not foreground this as a user-facing warning. Silent modification of package files undermines informed consent and can let reviewed behavior diverge from currently executing behavior.
The changelog states that users in mainland China are routed through a specific mainland network by default, with an alternate international approval page only if another sign-in method is needed. Region-specific routing without explicit user opt-in can create privacy, policy, and trust risks because users may not understand which infrastructure or jurisdiction their authentication data is traversing.
The document states that the client silently checks for updates and automatically installs newer releases without separate confirmation. Even though the text describes multiple integrity checks and trusted endpoints, silent default auto-installation changes executable/package files without an explicit user approval step, which increases supply-chain and operational risk if the update channel, signing process, or trust assumptions are ever compromised.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The documentation describes an automatic installation-registration telemetry call that is unrelated to the skill's stated purpose of generating wealth-product talking clips. Even if the data is framed as non-billable and best-effort, collecting environment, channel, network-route, and install-source metadata creates an unnecessary reporting surface that can disclose operational context and surprise users.
No suspicious patterns detected.