ai-logo-maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:08 AM UTC
• Version: 0.1.6

Overview

This logo skill is coherent as a Beatra logo generator, but it also uses broad account authority, a shared persistent token, arbitrary remote tool invocation, telemetry, and silent self-updates that deserve Review before installation.

Install only if you are comfortable giving this Beatra package a persistent shared credential with broad media and wallet-related authority, automatic updates enabled by default, and limited installation telemetry. Consider disabling auto-updates immediately, using a dedicated Beatra account or payment balance, and avoiding confidential uploads unless you trust Beatra's MCP and upload infrastructure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:31

Finding

Overprivileged Shared Device Token and Unrestricted Remote Tool Invocation

Content

View full analysis

dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared functionality is AI logo creation and refinement. Its legitimate minimum privileges include selected image uploads, image generation or editing, model lookup when needed, and access to associated task results. The requested shared token also includes unrelated capabilities for video, music, speech, voice creation, task cancellation, and wallet spending. In addition, the generic `call` command accepts an arbitrary tool name without a local allowlist restricting execution to the logo ...[truncated 1360 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mcp_client.py:230

Finding

Local File Uploads Can Be Directed to Any HTTPS Host Returned by the MCP Service

Content

View full analysis

dict[str, str]: structured = result.get("structuredContent") instruction = structured.get("upload") if isinstance(structured, dict) else None if not isinstance(instruction, dict) or instruction.get("method") != "PUT": raise RuntimeError("Beatra upload instructions are invalid") url = instruction.get("url") headers = instruction.get("headers") if not isinstance(url, str) or not isinstance(headers, dict): raise RuntimeError("Beatra upload instructions are invalid") parsed = urllib.parse.urlsplit(url) if ( parsed.scheme != "https" or not parsed.hostname or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise RuntimeError("Beatra upload instructions are invalid") if not all(isinstance(key, str) and isinstance(value, str) for key, value in headers.items()): raise RuntimeError("Beatra upload instructions are invalid") content_type = _header_value(headers, "Content-Type") content_length = _header_value(headers, "Content-Length") if content_type != mime_type or content_length != str(len(content)): raise RuntimeError("Beatra upload instructions are invalid") response = put_bytes(url, dict(headers), content) artifact_id = response.get("artifact_id") if not isinstance(artifact_id, str) or not artifact_id: raise RuntimeError("Beatra upload returned an invalid response") return {"type": "artifact", "artifact_id": artifact_id} ``` ### Technical Analysis The upload code verifies that the URL uses HTTPS and does not contain embedded ...[truncated 1683 chars]

Remediation

View remediation

other

Warning

• Location: scripts/authorize.py:340

Finding

Hostname, Agent Platform, and Stable Installation Identifier Are Collected and Transmitted

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` ```python external_reference = _installation_reference(state_dir) form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEVICE_AUTHORIZATION_URL, form) ``` ```python result = sess ...[truncated 2295 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:916

Finding

Silent Automatic Updates Can Replace Executable Skill Files After Review

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( insta ...[truncated 3079 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as generating/refining logos, yet it also documents uninstall and authorization-revocation behavior that reads and modifies local state and may remove credentials/configuration. Packaging destructive account and installation operations inside a creative skill increases the chance of unexpected system changes and makes review harder.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as generating/refining logos, yet it also documents uninstall and authorization-revocation behavior that reads and modifies local state and may remove credentials/configuration. Packaging destructive account and installation operations inside a creative skill increases the chance of unexpected system changes and makes review harder.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as generating/refining logos, yet it also documents uninstall and authorization-revocation behavior that reads and modifies local state and may remove credentials/configuration. Packaging destructive account and installation operations inside a creative skill increases the chance of unexpected system changes and makes review harder.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 71)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The requested OAuth scope is far broader than this skill’s stated purpose of generating logos and icons. In addition to image generation, it requests videos, music, speech, voice management, wallet spending, and task/artifact controls, creating unnecessary blast radius if the credential is compromised or the skill is abused.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The explicit self-update feature enables the package to modify its own installed code on disk. Even with validation steps, self-modifying behavior is high risk in a third-party skill because it creates a remote-controlled path to alter executable code after installation, which is disproportionate to a logo-generation tool's purpose.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Referencing credentials.json as part of the state the script manages indicates the package is designed to interact with shared credential material. In the context of a logo-maker skill, any capability to access or remove shared credentials is over-privileged and dangerous because it can affect authentication for unrelated skills and potentially expose or destroy secrets.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The _device_token function reads an access token from credentials.json and returns it for use in authorization revocation. This is direct credential access by a skill whose documented purpose is logo creation, making the behavior unjustified and increasing the chance of token misuse, exfiltration, or destructive account actions if the package is modified or abused.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares no explicit tool scope even though its documented behavior relies on shell, network, file read/write, and environment access. That lack of least-privilege scoping increases blast radius if the skill is misused, compromised, or later modified, because the host cannot constrain it to only the minimum capabilities needed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes self-update and installation-management capabilities unrelated to its core logo-making function. Even with integrity-check claims, self-update logic introduces a supply-chain and persistence surface that can modify local files over time, increasing risk compared with a static content-generation skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes logo generation, but the documentation adds automatic remote package update behavior that can replace files in the installed skill directory. That hidden system-modifying behavior creates a trust-boundary violation: users may invoke a design tool without realizing it can alter local software state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states that newer packages install automatically without separate confirmation during normal command execution, but the skill's primary description does not clearly warn about this behavior. Silent updates are especially risky in a skill with shell, filesystem, and network capabilities because they can change trusted code without fresh user review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json

"icon": "https://beatra.ai/textures/icons/ai-logo-maker-0.1.0.png",
  "localized": {
    "en": {
      "description": "Turn a brand name, industry, or reference image into a professional AI logo, brand mark, or app icon. This AI logo maker and logo generator explores multiple design directions from your brand brief—company name, industry feel, and color preferences—then refines the strongest concept with precise brand colors, clean geometry, and scalable composition. Create business logos, startup logos, monograms, emblems, and combination marks that stay sharp from favicon to storefront sign. Start from a text description, transform existing sketches and brand assets into a polished mark, or refine an accepted draft toward a publish-ready result.",
      "display_name": "AI Logo Maker",
      "summary": "Turn a brand name, industry, or reference image into a professional AI logo, brand mark, or app icon with multi-concept exploration, precise brand colors, and scalable composition.",
      "tags": [

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document explicitly states that the client silently checks for and automatically installs newer releases by default without separate confirmation. Even though the text describes integrity checks and rollback protections, silently replacing installed package files changes local software state without an explicit just-in-time user consent flow, which creates supply-chain and user-trust risk if the update channel is compromised or if users are unaware that commands can modify system files.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 64)May include surrounding context.

md

the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
  detect completion yourself — never ask the user to confirm in chat that
  they approved.

Approval legitimately takes minutes when sign-in or account creation is

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation states that the client automatically performs a network registration call on first use and transmits package slug, version, platform, and a stable external installation reference. Even if described as non-billable and non-secret, this is telemetry-like behavior and there is no indication of an explicit user-facing notice, consent, or opt-out, which creates privacy and transparency concerns and can violate user expectations or organizational policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The authorization flow collects and persists host platform, device name, installation path, and a local inventory of installed skills. For a logo-maker skill, this exceeds functional necessity and increases privacy exposure by tying credentials to host identity and software inventory that could be sensitive on managed or enterprise machines.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements a full remote self-update mechanism that downloads manifests and archives and then replaces local package files. Even though it includes several integrity checks, this materially expands the skill's power beyond logo generation and creates a code-modification channel that could be abused if the vendor infrastructure, signing/checksum workflow, or update policy is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.