T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/authorize.py:34- Finding
Overprivileged Device Token and Unrestricted Remote Tool Dispatch
- Content
View full analysis
- Remediation
View remediation
Security audit
corporate-podcast-studio
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a podcast-production workflow, but it uses a broad shared Beatra account token, unrestricted remote tool dispatch, and silent self-updates that users should review before installing.
Install only if you are comfortable giving this Beatra skill a shared account-level device token that can access more than podcast-specific tools and can spend credits through Beatra. Review or disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if you want confirmation before local package files change, and treat uninstall/disconnect as account-affecting because it may revoke the shared Beatra device connection when this is the last Beatra skill.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/authorize.py:121- Finding
Windows Credential File Permissions Are Neither Restricted nor Validated
- Content
View full analysis
None: # POSIX gets explicit 700/600. On Windows the state directory lives under # the user profile, whose default ACL is already private to the user — # the same posture as gh/aws/gcloud credential stores. The former custom # DACL ceremony was dropped deliberately: its command patterns read as # hostile to agent safety policies and endpoint security, failing installs # while adding no protection an elevated administrator could not bypass. path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` The Windows credential read path accepts the file without inspecting its ACL: ```python def _read_private_credentials(state_dir: Path, path: Path) -> str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` ### Technical Analysis On POSIX systems, the implementation creates the state directory with mode `0700`, stores credential files with mode `0600`, and validates ownership, file type, and permissions before reading the token. On Windows, the implementation assumes that ...[truncated 1814 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (34)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated purpose is podcast creation, but the referenced behavior includes uninstall logic, modification of local state under ~/.beatra, network revocation of authorization, and deletion of local credentials/configuration. Bundling destructive lifecycle operations into a content skill creates a risk of accidental denial of service or credential loss under misleading expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated purpose is podcast creation, but the referenced behavior includes uninstall logic, modification of local state under ~/.beatra, network revocation of authorization, and deletion of local credentials/configuration. Bundling destructive lifecycle operations into a content skill creates a risk of accidental denial of service or credential loss under misleading expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated purpose is podcast creation, but the referenced behavior includes uninstall logic, modification of local state under ~/.beatra, network revocation of authorization, and deletion of local credentials/configuration. Bundling destructive lifecycle operations into a content skill creates a risk of accidental denial of service or credential loss under misleading expectations.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The OAuth scope request is far broader than the skill’s stated purpose of producing corporate podcasts. In addition to speech/media features, it asks for artifacts access, task control, voice management, and notably wallet:spend, creating an unnecessary high-value authorization surface if the token is compromised or the backend misuses granted permissions.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 98% confidence
- Finding
The client explicitly implements self-modification through a self-update command and supporting updater pipeline. Any feature that can replace local code from remote content is inherently high risk, and here it is especially unjustified because the skill's purpose is media/podcast generation rather than package management; compromise of the upstream distribution path would directly turn normal skill use into code replacement.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The uninstall script manages shared device credentials and cross-skill inventory under ~/.beatra, which is a privileged capability unrelated to the advertised podcast-generation purpose of the skill. Even if framed as uninstall hygiene, bundling global credential and inventory logic into a content-production skill expands the blast radius: uninstalling this package can affect other installed skills and the user’s broader agent environment.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
Referencing credentials.json as part of the uninstall state set shows the script is designed to interact with shared credential material rather than only package-local files. In a podcast-generation skill, access to credential-bearing files is unnecessary and increases risk of credential misuse, accidental deletion, or future abuse if the package is altered.
- Content
python #: these and then removes the directory only if it is empty — the script #: never recursively deletes a directory it does not fully understand. _STATE_FILES = ( "credentials.json", "installation.json", "host.json", "skills.json",
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code constructs and sends an authenticated revocation request using a bearer token from shared local state, then later deletes local auth-state files. In the context of a podcast skill, that gives the package power to revoke a shared device authorization and interfere with other skills’ access, which is disproportionate and dangerous if the script is triggered unexpectedly or modified.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The _device_token function reads an access token directly from ~/.beatra/credentials.json so the script can use it in an Authorization header for revocation. Direct credential access by a skill package is dangerous because the same pattern could be repurposed to exfiltrate or abuse bearer tokens, and it is not justified by the declared podcast studio functionality.
- Content
python def _device_token(state_dir: Path) -> str | None: path = state_dir / "credentials.json" try: value = json.loads(path.read_text(encoding="utf-8")) except (OSError, ValueError):
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares no explicit tool restrictions even though it instructs use of shell, network, file read/write, and environment-capable operations via a bundled client. Without scoped permissions, an agent may invoke broader local and remote capabilities than users would expect from a podcast-generation skill, increasing the blast radius of prompt injection or operator error.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation guidance says to use the skill when an executive or company show needs serialized podcast episodes from a cloned or catalog host voice, but it does not provide explicit trigger phrases, exclusions, or negative examples. Because many ordinary corporate podcast requests could fit this description, the boundary between this skill and adjacent podcast-generation skills is somewhat ambiguous.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill enables silent self-updating of the bundled client without separate confirmation, which means local executable/package files may be modified during normal podcast operations. Even with verification claims, automatic code replacement expands supply-chain risk and removes an important user approval checkpoint for behavior changes on the host.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
A podcast studio skill has no clear need to perform automatic software update checks and installations as part of its operational instructions. Embedding updater behavior into the workflow increases attack surface and can normalize unnecessary privileged file/network activity unrelated to the user's immediate task.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill allows silent automatic update installation by default without prominent warning that local files may be modified. In context, this is more dangerous because the skill is presented as a media-production workflow, so users are less likely to anticipate host-level software changes occurring as a side effect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document explicitly states that the client performs silent update checks by default and automatically installs newer releases without separate confirmation. Even though it describes verification and rollback safeguards, this is still system-modifying behavior initiated without an explicit per-update user approval, which creates supply-chain and user-consent risk if the update channel or signing assumptions ever fail.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md the user signs in or creates their account there, and the approval page continues automatically after sign-in; - say once that the connection continues automatically after Allow, then detect completion yourself — never ask the user to confirm in chat that they approved. Approval legitimately takes minutes when sign-in or account creation is
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The code fingerprints the host agent platform from environment variables and captures the device hostname, then persists that data locally and transmits it during authorization. For a podcast-generation skill, this collection is not clearly necessary and increases privacy and reconnaissance exposure by tying credentials to host identity metadata.
- Content