T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Overprivileged Device Authorization Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
apartment-kitchen-tour
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent kitchen-video workflow, but it grants and uses broader Beatra account authority than the one-photo task needs and silently updates local executable files.
Install only if you are comfortable giving this package a shared Beatra device credential that can access more than kitchen-video generation and with automatic code updates enabled by default. Consider disabling auto-updates with the documented command and treating the Beatra credential as account-level access, not a single-purpose kitchen-video permission.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/mcp_client.py:1463- Finding
Unrestricted Remote Tool Dispatch Using a Full-Scope Credential
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call.add_argument("tool_name") ``` ### Technical Analysis The CLI accepts an arbitrary tool name and forwards an arbitrary JSON object from standard input to `tools/call`. There is no allowlist restricting execution to tools needed by the Apartment Kitchen Tour workflow. This becomes particularly dangerous because `Session` authenticates requests using the broad bearer token from `~/.beatra/credentials.json`. The package's narrative instructions advise use of selected tools, but those instructions do not create an enforceable security boundary. Any local caller or manipulated Agent instruction capable of invoking the bundled client can select another server-exposed tool. ### Attack Path 1. The user completes Device Authorization, creating a full-scope credential. 2. An attacker influences an Agent instruction, local automation, or direct CLI invocation. 3. The attacker supplies an unrelated tool name to: `python3 scripts/mcp_client.py call `. ...[truncated 615 chars]- Remediation
View remediation
` interface from the production Skill package and replacing it with dedicated subcommands. ]]>
other
Note
- Location
scripts/authorize.py:340- Finding
Collection and Transmission of Local Host Identification
- Content
View full analysis
str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The collected value is included in the authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEVICE_AUTHORIZATION_URL, form) ``` ### Technical Analysis The authorization helper inspects pr ...[truncated 1561 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:969- Finding
Silent Retrieval and Installation of Mutable Remote Code
- Content
View full analysis
bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( ins ...[truncated 2702 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mcp_client.py:231- Finding
Unrestricted HTTPS Host in Server-Directed Photo Upload
- Content
View full analysis
dict[str, str]: structured = result.get("structuredContent") instruction = structured.get("upload") if isinstance(structured, dict) else None if not isinstance(instruction, dict) or instruction.get("method") != "PUT": raise RuntimeError("Beatra upload instructions are invalid") url = instruction.get("url") headers = instruction.get("headers") if not isinstance(url, str) or not isinstance(headers, dict): raise RuntimeError("Beatra upload instructions are invalid") parsed = urllib.parse.urlsplit(url) if ( parsed.scheme != "https" or not parsed.hostname or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise RuntimeError("Beatra upload instructions are invalid") if not all(isinstance(key, str) and isinstance(value, str) for key, value in headers.items()): raise RuntimeError("Beatra upload instructions are invalid") content_type = _header_value(headers, "Content-Type") content_length = _header_value(headers, "Content-Length") if content_type != mime_type or content_length != str(len(content)): raise RuntimeError("Beatra upload instructions are invalid") response = put_bytes(url, dict(headers), content) artifact_id = response.get("artifact_id") if not isinstance(artifact_id, str) or not artifact_id: raise RuntimeError("Beatra upload returned an invalid response") return {"type": "artifact", "artifact_id": artifact_id} ``` ### Technical Analysis The client validates that the upload URL uses HTTPS and does not contain embedded creden ...[truncated 1784 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (39)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated listing-video purpose does not prepare users for uninstall/disconnect behavior that reads and mutates local state under ~/.beatra, inspects installed skills, revokes authorization, and removes credentials. Hidden lifecycle operations affecting local files and account state are security-relevant and should not be bundled opaquely with a simple media skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated listing-video purpose does not prepare users for uninstall/disconnect behavior that reads and mutates local state under ~/.beatra, inspects installed skills, revokes authorization, and removes credentials. Hidden lifecycle operations affecting local files and account state are security-relevant and should not be bundled opaquely with a simple media skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated listing-video purpose does not prepare users for uninstall/disconnect behavior that reads and mutates local state under ~/.beatra, inspects installed skills, revokes authorization, and removes credentials. Hidden lifecycle operations affecting local files and account state are security-relevant and should not be bundled opaquely with a simple media skill.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bundled `scripts/mcp_client.py`. Do not configure a host Beatra
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bundled `scripts/mcp_client.py`. Do not configure a host Beatra
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bundled `scripts/mcp_client.py`. Do not configure a host Beatra
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bundled `scripts/mcp_client.py`. Do not configure a host Beatra
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bundled `scripts/mcp_client.py`. Do not configure a host Beatra
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bundled `scripts/mcp_client.py`. Do not configure a host Beatra
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document states that a single approval covers image, video, music, speech, upload, model, and task tools, which is far broader than the apartment-kitchen-tour skill’s stated one-photo-to-one-kitchen-clip purpose. This creates unnecessary privilege scope and a capability mismatch: compromising or misusing this skill could grant access to unrelated account functions beyond what the user would reasonably expect.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill documentation explicitly introduces access to unrelated Beatra capabilities such as music, speech, and general task tools. In the context of a narrowly scoped real-estate kitchen animation skill, exposing broader platform capabilities violates least privilege and increases the blast radius if the skill is abused or the credential is stolen.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script requests an extremely broad OAuth scope set, including wallet spending, task control, voice access, and multiple generation capabilities that are unrelated to a skill described as turning one kitchen photo into a short clip. Excessive scopes violate least privilege and significantly increase blast radius if the token is misused, leaked, or if the skill behavior expands beyond the user's expectation.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file is a generic remote MCP client with session management, tool discovery, arbitrary tool invocation, upload support, telemetry, and update logic, which is far broader than a kitchen-photo animation skill needs. That mismatch materially increases attack surface and enables the package to act as a general-purpose remote command conduit under the guise of a narrowly described media skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The package downloads manifests and archives and then replaces installed files on disk, effectively giving the remote service the ability to change local code after installation. Even with checksum validation, the trust root is the remote discovery channel, so compromise or misuse of that channel can push new behavior unrelated to the user-approved kitchen-tour skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The CLI supports listing all remote tools and calling any named tool with JSON from stdin, turning the package into a generic broker for arbitrary remote capabilities. For a skill advertised as producing a single kitchen-photo clip, this is especially dangerous because users and reviewers may not expect broad remote tool access hidden behind a domain-specific package.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The exposed update command explicitly enables self-modification of the installed package, allowing local executable code to be replaced from network-fetched content. In the context of a narrowly described kitchen-tour skill, self-modification is unjustified and materially raises the risk of post-install behavior drift or malicious code delivery via the update path.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The uninstall script manages a shared Beatra device connection, inventory, and credential lifecycle, which is materially unrelated to the skill’s advertised function of generating a kitchen-photo animation. Even if framed as package cleanup, this gives the skill authority over shared authentication state for other skills, creating a risky mismatch between declared purpose and actual capability.
- Content