Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its stated video-generation purpose, but it uses a broad shared Beatra account token and silently self-updates by default, so users should review it before installing.
Install only if you are comfortable granting this package access to your existing Beatra device authorization and Beatra credit-spending capabilities. Before using it, consider disabling silent updates with `python3 scripts/mcp_client.py update --auto off`, review Beatra account permissions/credit balance, and use the uninstall script if you later want the package removed without accidentally breaking other Beatra skills.
The documented package scope is media creation, yet related referenced behavior includes uninstall logic, modification of local Beatra state, token revocation, and installed-skill inventory inspection. Even if these are lifecycle functions, they are security-sensitive host-management actions that are materially different from clip generation and should not be concealed behind a creative-tool description.
The documented package scope is media creation, yet related referenced behavior includes uninstall logic, modification of local Beatra state, token revocation, and installed-skill inventory inspection. Even if these are lifecycle functions, they are security-sensitive host-management actions that are materially different from clip generation and should not be concealed behind a creative-tool description.
The documented package scope is media creation, yet related referenced behavior includes uninstall logic, modification of local Beatra state, token revocation, and installed-skill inventory inspection. Even if these are lifecycle functions, they are security-sensitive host-management actions that are materially different from clip generation and should not be concealed behind a creative-tool description.
Referencing a local credential file in the manifest indicates the skill can use bearer credentials from the user's environment to authenticate to a remote service. In the context of a simple FAQ clip-generation skill, this is disproportionately powerful and could enable unauthorized account access, remote operations, or abuse of the user's Beatra identity if the skill is overprivileged or compromised.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The helper requests a very broad OAuth scope set, including wallet spending, voice write, music generation, task cancellation, and broad artifact access, which is far beyond what is needed to generate spoken FAQ clips. If the credential is stolen or the skill is abused, the excessive permissions significantly expand blast radius to billing, data access, and unrelated content-generation capabilities.
This file contains a complete remote update and installer pipeline that downloads manifests and archives, validates them, and replaces local package files. For a skill whose stated purpose is producing spoken FAQ clips, this is materially out of scope and creates a strong supply-chain and self-modification risk: compromise of the update channel or publisher infrastructure would let remote code be installed on the user's machine.
The skill exposes an explicit self-update/self-modification capability via its CLI and supports replacing its own installed code. In the context of a content-generation skill, self-modification is especially dangerous because it expands the trust boundary from the local reviewed package to ongoing remote code delivery, enabling supply-chain compromise or unexpected behavior changes after installation.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill invokes shell commands, reads local files, uploads artifacts, and performs networked remote operations, but it declares no explicit tool scope or permission boundary. That increases the chance a host grants broader-than-necessary capabilities, making misuse of filesystem, network, or shell access harder to audit and contain.
The skill instructs the agent to translate official billing or top-up prose, which imposes a language transformation without any user opt-in or stated locale preference. This is a natural-language policy concern because it prescribes language handling rather than offering the user a choice.
These lines again require the agent to translate official prose while preserving the URL, with no indication that the user requested or consented to the language change. Requiring a specific language behavior across the workflow can violate locale-choice expectations.
The instruction directs the agent to translate official billing prose automatically, which is a language-policy decision applied to users regardless of their preference. Because no opt-in or locale selection is described, this creates a policy issue.
This is another instance of the workflow requiring automatic translation of official system messaging without user choice. Repeated mandatory translation across stages indicates a consistent locale-policy issue rather than a one-off wording choice.
The skill includes automatic self-update and installation behavior unrelated to generating FAQ clips. Any component that can silently replace packaged files expands the trust boundary and creates supply-chain risk: if the update channel, signing, or verification process fails, the skill could change behavior after review without fresh user consent.
The changelog states that users in mainland China will connect through a mainland network by default, with an alternative international sign-in method only if needed. This is a locale-specific behavior described in natural language without presenting it as an explicit user choice or clearly justified regional compliance requirement.
The manifest grants this skill access to a remote MCP service authenticated with a local device-bearer credential file, even though the stated purpose is narrowly limited to turning written FAQ content into talking clips. That creates unnecessary credential and network reach beyond what users would reasonably expect, increasing the risk of data access, account misuse, or remote action through the MCP backend if the skill or backend is abused.
The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation. Even with integrity checks, default-on silent self-modifying behavior increases supply-chain and user-consent risk because code on the system can change unexpectedly before ordinary commands run.