Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its product-video purpose, but it also uses broad Beatra account authorization and silent self-updates, so it belongs in Review before installation.
Review this before installing if you are not comfortable with a shared Beatra device token that can spend credits and access multiple Beatra tool categories, or with the package updating its own installed files automatically. The core video workflow is user-confirmed and well documented, but disable automatic updates if you want every package change to be deliberate.
The skill documentation references uninstall behavior, deletion of local state, inspection of installed skills, and revocation of shared authorization, all of which are outside the advertised media-generation role. Combining destructive local operations and credential lifecycle management inside a content-creation skill increases the blast radius if the skill is misused or compromised.
The skill documentation references uninstall behavior, deletion of local state, inspection of installed skills, and revocation of shared authorization, all of which are outside the advertised media-generation role. Combining destructive local operations and credential lifecycle management inside a content-creation skill increases the blast radius if the skill is misused or compromised.
The skill documentation references uninstall behavior, deletion of local state, inspection of installed skills, and revocation of shared authorization, all of which are outside the advertised media-generation role. Combining destructive local operations and credential lifecycle management inside a content-creation skill increases the blast radius if the skill is misused or compromised.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
paid stage and confirm it before execution. Freeze explicit `9:16` and
`720p` controls only when the selected live card admits them; if it derives
output from source frames, confirm both boundaries are approved `9:16`
frames and disclose that source-derived output rule instead.
If a user requests both a strict product first frame and a supplied motion
reference, explain the strict-frame and reference-video routes, their current
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
paid stage and confirm it before execution. Freeze explicit `9:16` and
`720p` controls only when the selected live card admits them; if it derives
output from source frames, confirm both boundaries are approved `9:16`
frames and disclose that source-derived output rule instead.
If a user requests both a strict product first frame and a supplied motion
reference, explain the strict-frame and reference-video routes, their current
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The OAuth scope string requests a very broad set of capabilities far beyond the stated purpose of creating a WeChat product video from product photos and metadata. If the issued credential is later used by this skill or any shared runtime component, compromise or misuse would grant access to unrelated high-value operations such as wallet spending, voice management, and task/artifact access, violating least privilege.
tasks:cancel is less severe than spending or credential-management scopes, but it still permits interference with unrelated operations and is not obviously necessary for the described product-video workflow. In a shared account or shared runtime, this could be abused to disrupt other active jobs.
The skill implements a full self-update mechanism that downloads remote manifests and archives, writes package files, maintains locks/journals, and changes the local installation, which is far beyond the advertised purpose of generating WeChat product videos. Even with checksum and path checks, a content-creation skill that can silently replace its own code materially expands trust and creates a software-supply-chain risk if the vendor infrastructure, discovery document, signing process, or update channel is compromised.
The presence of a built-in self-update command confirms that this skill can intentionally modify its own installed code, which exceeds the reasonable expectations for a product-video generator. In context, self-modification is especially concerning because the skill's declared function is narrow and creative, so code-changing behavior represents hidden privileged capability rather than core functionality.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The function reads an access token from ~/.beatra/credentials.json so it can use that bearer token to call the revocation endpoint. Accessing shared credentials from within a skill uninstall script is dangerous because it grants the package direct interaction with authentication material outside its declared purpose, and a compromised or altered script could exfiltrate or misuse the token.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool scope even though its instructions require shell, network, file access, and environment interaction via a bundled client. That creates an overly broad and opaque execution surface, making it harder for a host to enforce least privilege or for users to understand what the skill can do.
The skill includes an automatic self-update mechanism that can replace package-owned files, which is unrelated to the core task of creating product videos. Any auto-update path materially increases supply-chain risk because future code changes can alter behavior after initial review, especially when the skill already has shell, file, and network capabilities.
The documentation says updates can install automatically without separate confirmation, but the skill's top-level description does not prominently warn that local package-owned files may be modified. Users may therefore grant trust for a media workflow without realizing the package can later change itself on disk.
The manifest changelog explicitly states the helper connects through a mainland China network by default and may open an approval page on an international site, but there is no indication of explicit user opt-in, clear routing disclosure, or consent handling in the manifest. Routing authentication or helper traffic through region-specific infrastructure can affect privacy, compliance, and trust boundaries, especially if users are unaware their sign-in flow or data path changes by geography.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
"icon": "https://beatra.ai/textures/icons/wechat-channels-product-video-0.1.1.png",
"localized": {
"en": {
"description": "Create a vertical WeChat Channels product-display video from a real product photo and confirmed product information. Shape a clear product opening, one detail or use moment, and a clean ending, then prepare the finished product video with a title and publishing copy for WeChat Channels product content, including a new-product showcase video.",
"display_name": "WeChat Channels Product Showcase Video Maker",
"summary": "Turn a real product photo and confirmed product details into a clear vertical WeChat Channels product showcase video, title, and publishing copy.",
"tags": [
The document states that the client silently checks for updates and installs newer versions automatically without separate confirmation. Even though later text describes integrity checks and rollback protections, silently replacing executable package files by default can surprise users, change local behavior unexpectedly, and increase supply-chain risk if the trusted update infrastructure is ever compromised.
No suspicious patterns detected.