Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Beatra thumbnail generator, but it uses a broad shared Beatra authorization and silently self-updates installed files by default.
Install only if you are comfortable granting Beatra a persistent shared device authorization with broad media and wallet-spend scope, local ~/.beatra state, registration telemetry, and default silent package updates. Consider disabling auto-updates with the documented command before use, and review Beatra account permissions and billing carefully before approving any paid render.
The skill claims to make thumbnails but also references uninstall/disconnect behaviors, local state inspection and deletion under ~/.beatra, installed-skill inventory checks, and network revocation of authorization. Those destructive/account-affecting operations are outside user expectations for an image-creation skill and could be abused to remove configuration, revoke access, or tamper with local state.
The skill claims to make thumbnails but also references uninstall/disconnect behaviors, local state inspection and deletion under ~/.beatra, installed-skill inventory checks, and network revocation of authorization. Those destructive/account-affecting operations are outside user expectations for an image-creation skill and could be abused to remove configuration, revoke access, or tamper with local state.
The skill claims to make thumbnails but also references uninstall/disconnect behaviors, local state inspection and deletion under ~/.beatra, installed-skill inventory checks, and network revocation of authorization. Those destructive/account-affecting operations are outside user expectations for an image-creation skill and could be abused to remove configuration, revoke access, or tamper with local state.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The host follows this computer's network route, described below.
They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another
The requested OAuth scope is far broader than needed for a YouTube thumbnail skill, including wallet spending, voice write, speech/music/video generation, and task/artifact capabilities unrelated to thumbnail creation. If the credential is compromised or the skill/runtime is abused, an attacker gains excessive privileges well beyond the advertised function of the skill.
The presence of a self-update command confirms that this skill is designed to modify its own code after installation. In the context of a thumbnail-generation skill, self-modification materially increases the blast radius of any server compromise, signing/distribution failure, or malicious update, because trusted local code can be replaced over time.
)
update = subparsers.add_parser(
"update",
help="Check, install, or configure Beatra package self-updates",
)
update.add_argument(
"--check",
The skill declares no explicit tool/permission scope even though its instructions require shell execution, local file access, environment access, and network operations. That overbroad and undeclared capability set weakens least-privilege controls and makes it easier for the skill or its bundled scripts to perform unexpected actions without clear user or platform review.
The changelog states that users in mainland China are routed through a separate mainland network and may be directed to a different approval/sign-in page, but it does not clearly frame this as an informed user choice or explain the trust, privacy, and jurisdictional implications. Region-specific authentication or traffic routing can expose users to unexpected data handling, alternate controls, or phishing-like confusion if users are silently sent to different infrastructure based on location.
The skill documentation describes a bundled client that silently checks for and automatically installs software updates before normal commands, which exceeds the stated purpose of generating YouTube thumbnails. Even with checksum and source verification, automatic self-update introduces code execution and local file modification behavior unrelated to the user-visible task, expanding the trust boundary and creating supply-chain risk if the update channel or signing/verification process is ever compromised.
The file states that update checks are silent, enabled by default, and that higher versions are installed automatically without separate confirmation. Silent installation is dangerous because it changes the local environment and executes newly delivered code without contemporaneous user consent, making any compromise of the update path materially impactful.
The default behavior performs update checks and automatic replacement of local package files before ordinary commands, but the user warning in this file does not appear to be surfaced as a clear runtime notice tied to installation impact. This weakens informed consent and can surprise users with software changes on their system, especially in a skill whose advertised purpose is only thumbnail creation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- say prominently that a signed-out browser lands on Beatra sign-in first:
the user signs in or creates their account there, and the approval page
continues automatically after sign-in;
- say once that the connection continues automatically after Allow — never
ask the user to confirm in chat that they approved.
- on the mainland China network, follow the sign-in and console-link guidance
in [MCP connection](mcp-connection.md#network-route).
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use one of `website`, `github`, `skillhub`, `skillatlas`, `modelscope`,
`workbuddy`, `clawhub`, or `other`. If the conversation does not show it,
skip this and do not ask the user. If the command is not recognized, skip it.
## Use the bundled MCP client
The authorization flow detects and persists host platform information and a recognizable device hostname, which goes beyond what is obviously necessary to authorize thumbnail generation. This creates avoidable local fingerprinting and may expose environment metadata that can aid tracking, correlation across sessions, or privacy loss if later transmitted or accessed by other components.
Maintaining a shared ~/.beatra/skills.json inventory of installed skills creates cross-skill visibility and durable local tracking not required for basic thumbnail authorization. In a shared runtime, this can reveal other installed packages and usage relationships, increasing privacy exposure and creating a larger target for local reconnaissance.
This client contains a full self-update mechanism that downloads, validates, and replaces files in its own installation, which is far beyond the stated thumbnail-generation purpose. Even with checksum validation, any compromise of the vendor release pipeline or misuse of the feature gives the skill ongoing code-execution and persistence capability on the host, significantly increasing trust and attack surface.
The client can silently replace its own installed files during normal operation without user-facing warning or approval. Silent code mutation increases persistence risk and defeats user expectations, making any upstream compromise or logic flaw far more dangerous than a normal single-run tool action.
No suspicious patterns detected.