Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Beatra media workflow, but it uses a broad shared Beatra token and silently updates its own code, so users should review it before installing.
Install only if you are comfortable giving this Beatra package a shared device authorization for broad Beatra media and account operations, and consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off` if you require explicit review before code changes. Review Beatra account permissions, billing exposure, and revocation options before using paid operations.
The authorization scope includes multiple unrelated generation and account-management permissions beyond producing talking clips from captions, such as music generation and voice read/write access. For this skill context, these extra privileges are not justified and would enable materially different actions than users would reasonably expect.
The package references uninstall/disconnect behaviors, local state inspection under user directories, credential usage, and revocation/network cleanup actions that are unrelated to the advertised caption-processing task. Bundling lifecycle and system-state management into a content-production skill expands its authority and creates opportunities for unintended local state access or destructive actions.
The package references uninstall/disconnect behaviors, local state inspection under user directories, credential usage, and revocation/network cleanup actions that are unrelated to the advertised caption-processing task. Bundling lifecycle and system-state management into a content-production skill expands its authority and creates opportunities for unintended local state access or destructive actions.
The package references uninstall/disconnect behaviors, local state inspection under user directories, credential usage, and revocation/network cleanup actions that are unrelated to the advertised caption-processing task. Bundling lifecycle and system-state management into a content-production skill expands its authority and creates opportunities for unintended local state access or destructive actions.
The skill includes silent automatic self-update and package replacement, which allows its executable behavior to change after review without fresh user approval. In a security-sensitive context, this undermines trust boundaries and can turn a previously reviewed skill into a delivery path for new risky behavior.
The manifest explicitly references a local credential file for device-bearer authentication, indicating the skill may access reusable account credentials to reach a remote service. In the context of a simple caption-conversion tool, this is higher risk because credentialed access is disproportionate to the advertised function and could enable account misuse or unauthorized data access if the skill or service is compromised.
},
"mcp": {
"authentication": "device-bearer",
"credential_file": "~/.beatra/credentials.json",
"name": "beatra",
"transport": "streamable-http",
"url": "https://mcp.beatra.ai/mcp"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The requested OAuth scope is far broader than the skill's stated purpose of turning insurance captions into talking clips. It includes write/read/cancel/task/media/voice capabilities unrelated to simple caption processing, violating least privilege and increasing blast radius if the stored token is abused or exfiltrated.
The authorization scope includes multiple unrelated generation and account-management permissions beyond producing talking clips from captions, such as music generation and voice read/write access. For this skill context, these extra privileges are not justified and would enable materially different actions than users would reasonably expect.
The file is a full remote MCP client with routing, credential use, installation registration, update logic, uploads, and arbitrary tool calls, which is far broader than the advertised purpose of converting YouTube insurance captions into talking clips. This mismatch materially increases attack surface and creates an unnecessary remote-control capability inside a narrowly scoped media skill.
The skill can silently download remote manifests and archives and then modify its own installed files. Even with checksum validation, this establishes a remote code-delivery channel unrelated to the declared caption-processing task and substantially increases the consequences of server compromise, signing/discovery compromise, or supply-chain abuse.
The code exposes generic remote tool listing and arbitrary tools/call invocation, allowing this skill to act as a general-purpose broker to backend capabilities beyond caption processing. In context, that overbroad functionality is dangerous because a supposedly narrow media skill can invoke unrelated remote actions using local credentials and network access.
The presence of a self-update command confirms that the package is designed to modify its own installed code after deployment. In a skill advertised for a simple media-processing workflow, self-modification is an unjustified high-risk capability because it opens a supply-chain execution path independent of the user’s expected task.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The uninstall script handles shared Beatra device credentials and revokes OAuth authorization, behavior that is unrelated to a skill described as converting YouTube insurance captions into talking clips. That mismatch is a strong indicator of hidden platform-level credential management and expands the skill’s privileges beyond its stated purpose, creating risk of unauthorized access to shared authentication state and disruption of other installed skills.
The presence of credentials.json in the enumerated state files shows the skill is aware of and targets shared credential material during uninstall. Even if used for cleanup, referencing shared credential storage in an unrelated media-processing skill increases the blast radius of compromise and signals overbroad access to sensitive authentication artifacts.
#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
"credentials.json",
"installation.json",
"host.json",
"skills.json",
This code reads an access token from credentials.json and later uses it to call a remote revocation endpoint, which is unrelated to the advertised caption-processing behavior. A skill with access to shared tokens can interfere with account connectivity, tamper with shared agent state, or normalize unauthorized credential access under the guise of uninstall behavior.
The _device_token function explicitly opens credentials.json and extracts access_token, granting the skill direct access to bearer credentials. Direct token access is dangerous because any malicious modification could exfiltrate, reuse, or revoke those credentials, and the functionality is not justified by the skill’s stated YouTube caption use case.
def _device_token(state_dir: Path) -> str | None:
path = state_dir / "credentials.json"
try:
value = json.loads(path.read_text(encoding="utf-8"))
except (OSError, ValueError):
The skill declares no explicit tool scope despite requiring powerful capabilities including shell, network, file read/write, and environment access. This weakens containment and reviewability, making it easier for the skill to perform actions beyond a user’s expectation or for future changes to expand behavior without clear permission boundaries.
The manifest presents a narrow media-generation purpose, while the body also authorizes YouTube lookups, wallet/ledger access, and package update behavior. Security-relevant hidden scope reduces informed consent and can cause users to expose account and billing data under false assumptions about what the skill does.