T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/authorize.py:33- Finding
Overprivileged Device Token and Unrestricted MCP Tool Dispatch
- Content
View full analysis
Vulnerability Details
File Location:
scripts/authorize.py:33-37
Vulnerability Type: Excessive authorization scope
Risk Level: HighVulnerable Code
python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" )The excessive scope is compounded by unrestricted tool dispatch at
scripts/mcp_client.py:1463-1479:python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, )Technical Analysis
The Skill declares image generation, transformation, and editing functionality. However, its authorization request also obtains privileges for video generation, music generation, speech generation, voice reading and modification, and wallet spending.
The MCP client accepts an arbitrary tool name and does not enforce a package-specific allowlist. Therefore, any process or agent capable of invoking the bundled client can attempt unrelated MCP operations using the shared bearer credential. Although the documentation discloses that approval covers several media types, these permissions exceed the minimum privileges needed by this image-focused Skill.
Attack
...[truncated 1276 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the shared full-scope request with the narrowest scopes required for:
- image generation and editing;
- approved artifact uploads;
- model capability and pricing lookup;
- task status retrieval;
- user-requested task cancellation;
- billing only where strictly necessary.
- Remove video, music, speech, and voice-write scopes from this package.
- Avoid broad wallet privileges where the API supports operation-specific spending authorization.
- Enforce an explicit MCP tool allowlist in
_run_command, covering only the tools documented by this Skill. - Reject unknown tool names locally before establishing a business-operation request.
- Use separate, narrowly scoped credentials for different Skill families rather than one shared full-scope bearer token.
- Add automated tests proving that unrelated media, voice, and account-management tools cannot be called through this package.
- Clearly display the exact requested scopes before the user approves authorization.
- Replace the shared full-scope request with the narrowest scopes required for: