Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its wedding-film purpose, but it also uses a broad shared Beatra account token and silent self-updates, so it needs review before installation.
Install only if you are comfortable granting this package a broad shared Beatra device authorization, letting it store credentials under ~/.beatra, access wallet/task/account metadata, and silently update its own package files. Consider disabling automatic updates with the documented update command, review each paid generation card carefully, and revoke the Beatra device authorization from the Beatra Console if you no longer trust the package.
The inclusion of tasks:read and tasks:cancel is not clearly justified by the skill description and permits visibility into and interference with task execution beyond simple media generation. While less severe than wallet access, these permissions could expose user activity metadata or allow disruption of unrelated work if the token is misused.
The skill also references uninstall/removal flows, deletion of local state, access to shared installed-skill inventory, credential access, and token revocation, none of which fit the expected behavior of a wedding opener generator. This is risky because a content-generation skill should not manage shared lifecycle state for other skills or touch broad local authentication material, as mistakes or abuse could disrupt other installations or expose secrets.
The skill also references uninstall/removal flows, deletion of local state, access to shared installed-skill inventory, credential access, and token revocation, none of which fit the expected behavior of a wedding opener generator. This is risky because a content-generation skill should not manage shared lifecycle state for other skills or touch broad local authentication material, as mistakes or abuse could disrupt other installations or expose secrets.
The skill also references uninstall/removal flows, deletion of local state, access to shared installed-skill inventory, credential access, and token revocation, none of which fit the expected behavior of a wedding opener generator. This is risky because a content-generation skill should not manage shared lifecycle state for other skills or touch broad local authentication material, as mistakes or abuse could disrupt other installations or expose secrets.
Automatic self-update is unrelated to wedding film generation and allows the bundled client to download, replace files, and modify the local installation outside the immediate user task. Any updater materially raises supply-chain risk; if the update channel, verification logic, or hosting is compromised, an attacker could gain code execution or persistent control under the trust granted to this skill.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
```
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The OAuth scope string requests a very broad set of capabilities, including artifacts, images, videos, music, speech, voices, wallet spending, and task operations. For a skill described as generating wedding opening film storyboard keyframes and an opening film, this exceeds least-privilege expectations and increases blast radius if the skill, its token storage, or downstream tool calls are abused.
The inclusion of tasks:read and tasks:cancel is not clearly justified by the skill description and permits visibility into and interference with task execution beyond simple media generation. While less severe than wallet access, these permissions could expose user activity metadata or allow disruption of unrelated work if the token is misused.
The file embeds a full package discovery, download, verification, rollback, and self-update mechanism that is unrelated to generating wedding opening films. In a skill context, this greatly expands the trust boundary: a creative skill can replace its own local code and manage installation state, creating persistent remote code delivery capability far beyond the declared purpose.
The client exposes general-purpose remote MCP tool listing and invocation rather than a narrowly scoped wedding-film operation. In context, this means the skill can act as a generic remote execution conduit to any available backend tools, which is substantially more dangerous than the stated creative use case and can enable misuse or privilege expansion through unrelated tool access.
Exposing self-update/self-modification functionality in a wedding-film skill materially increases the attack surface and persistence of the package. A skill whose purpose is media generation should not be able to replace its own codebase on disk, because that turns a narrowly scoped tool into a remotely updateable software agent.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The uninstall script can revoke a shared Beatra device authorization and delete shared state under ~/.beatra, which affects all installed skills on the device rather than only this wedding-film package. That capability is broader than the advertised media-generation purpose, so if invoked unexpectedly or in error it can disrupt unrelated skills and remove credentials from the host.
The script is designed to delete credentials.json and other files in the shared ~/.beatra state directory, demonstrating direct handling of sensitive credential material. Even though the code does not exfiltrate the token here, access to shared credential files in an unrelated wedding-film skill is dangerous because compromise or misuse could disable or manipulate the user's broader Beatra access.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
The function reads access_token from ~/.beatra/credentials.json and uses it to authenticate a revocation request. Reading bearer tokens from shared local storage gives this skill effective control over the device authorization, which is excessive for the declared wedding-film functionality and creates unnecessary credential exposure.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool scope, yet its instructions require shell execution, network access, local file interaction, and likely environment/credential access via the bundled client. That creates excessive implicit privilege and makes it easier for the skill to perform sensitive operations beyond what a user would reasonably expect from a wedding media generator.
Account-balance and billing-ledger access is not strictly necessary to generate wedding opening films and introduces access to financial/account metadata. Even if intended for cost confirmation, exposing wallet and ledger operations in a media skill increases unnecessary data access and could leak spending history or facilitate profiling of the user's account usage.
The document states that the client silently checks for and automatically installs higher versions without separate confirmation. Even with integrity and rollback protections described later, silent system modification changes code on the user's machine without an explicit just-in-time consent prompt, which creates a supply-chain and user-consent risk if the update channel is ever compromised or misconfigured.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
The helper opens no local listener and requires no inbound connection. One