Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly coherent for writing WeChat articles with images, but it needs Review because it uses broad Beatra account authority, stored bearer credentials, telemetry, and silent self-updates beyond the narrow article-image task.
Install only if you are comfortable granting this package a shared Beatra device token with spending-capable, multi-media MCP authority and allowing default silent package updates. Before use, consider disabling auto-updates with scripts/mcp_client.py update --auto off, review the Beatra approval page carefully, and avoid uploading brand references or private article content unless that external transmission is acceptable.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",VirusTotal findings are pending for this skill version.
No suspicious patterns detected.