ClawHub
Back to skill

Security audit

coworking-day-pack

Security checks for vulnerabilities and agentic risk

Overview

This playlist skill is functional but asks for broad account authority and can silently replace its own code, so it should be reviewed carefully before installation.

Install only if you are comfortable granting Beatra a shared, broad device token that can reach more than music generation and spend credits. Turn off automatic updates with the documented update --auto off command if you require reviewed code to stay fixed, and treat wallet, upload, and uninstall/disconnect actions as account-impacting operations.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/authorize.py:35
Finding

Overprivileged Device Authorization Exceeds the Skill's Functional Requirements

Content
View full analysis

Vulnerability Details

File Location: scripts/authorize.py:35-38
Vulnerability Type: Excessive OAuth authorization scope
Risk Level: High

Vulnerable Code:

python
SCOPE = (
    "mcp:tools artifacts:write images:generate videos:generate music:generate "
    "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel"
)

Technical Analysis

The Skill is declared as a coworking playlist generator. Its legitimate operations include reading music-model information, generating music, reading and canceling associated tasks, and accessing the wallet functions required for estimates or billing.

The requested Device Token also grants unrelated permissions for image generation, video generation, speech generation, voice reading and writing, and generic artifact access. The broad mcp:tools permission may further expand the effective authority available through the MCP endpoint.

This violates least privilege because compromise or misuse of the shared token would provide access to capabilities that are not required to produce coworking music playlists. The documentation confirms that this broad authorization is intentional at references/installation-and-auth.md:73-74 and that the token is shared across Beatra Skills at references/mcp-connection.md:9-10.

Attack Path

  1. The user runs scripts/authorize.py.
  2. The authorization request includes the complete scope shown above.
  3. The user approves the Device Authorization, and the resulting bearer token is stored in ~/.beatra/credentials.json.
  4. An attacker who compromises the credential, the local client, or another component with access to the shared credential uses it against the Beatra MCP endpoint.
  5. The attacker invokes unrelated image, video, speech, voice, or artifact operations and may spend account credits through permissions that this playlist Skill did not legitimately require.

Impact Ass

...[truncated 655 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the full cross-media scope with a package-specific least-privilege scope limited to:
    • Music generation.
    • Music-model and pricing reads.
    • Task reads for tasks created by this package.
    • Cancellation of tasks created by this package.
    • Narrowly scoped wallet balance, ledger, and spending operations where required.
  2. Remove image, video, speech, and voice permissions from this Skill's authorization request.
  3. Avoid a generic mcp:tools grant when individual tool or capability scopes can be enforced.
  4. Bind authorization to the package identity and enforce that identity server-side rather than relying only on telemetry fields such as source_package_slug.
  5. Use separate credentials or capability tokens for unrelated Beatra Skills so compromise of one package does not expose every enabled media capability.
  6. Display the exact requested capabilities to the user before opening the authorization page.
  7. Add automated tests that compare the requested scopes against an explicit allowlist for the coworking playlist workflow.

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/mcp_client.py:969
Finding

Silent Automatic Replacement of Executable Package Files Without Independent Signature Verification

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:969-1020, with invocation at scripts/mcp_client.py:1542-1543
Vulnerability Type: Automatic remote payload retrieval and installation
Risk Level: High

Vulnerable Code:

python
def maybe_auto_update(
    *,
    state_dir: Path | None = None,
    install_root: Path | None = None,
    get_bytes: GetBytes = _default_get_bytes,
    now: float | None = None,
) -> bool:
    """Best-effort silent update. Never block the requested MCP command."""

    resolved_state = state_dir or Path.home() / ".beatra"
    try:
        resolved_root = (install_root or _current_install_root()).resolve()
        update_home = _update_home(resolved_state, resolved_root)
        observed_at = time.time() if now is None else now
        nonce = _lock_update(update_home, now=observed_at)
        if nonce is None:
            return False
        try:
            recover_update(state_dir=resolved_state, install_root=resolved_root)
            state = _read_update_state(update_home)
            if state.get("auto_update", True) is False:
                return False
            last_checked = state.get("last_checked_at")
            if (
                isinstance(last_checked, (int, float))
                and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS
            ):
                return False
            state["last_checked_at"] = observed_at
            _write_private_json(update_home / "state.json", state)
            checked = check_update(get_bytes=get_bytes)
            if not checked["update_available"]:
                return False
            _ensure_owned_baseline(
                install_root=resolved_root,
                update_home=update_home,
                get_bytes=get_bytes,
            )
            discovery = checked["discovery"]
            manifest, new_files = download_u
...[truncated 3882 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable automatic installation by default. Permit automatic update checks, but require explicit informed user approval before replacing executable files.
  2. Sign the release manifest with an offline or otherwise strongly protected signing key and embed the corresponding public key in the reviewed client.
  3. Verify the signature before trusting the version, archive hash, file hashes, or file list. Reject unsigned releases and unknown signing keys.
  4. Define a documented key-rotation procedure using cross-signed replacement keys or a threshold-signature policy.
  5. Consider publishing releases through a transparency log so clients can detect targeted or equivocated updates.
  6. Preserve the existing fixed-host, redirect-rejection, path-validation, size-limit, checksum, ownership, rollback, and downgrade-prevention controls as defense in depth.
  7. Show the current version, target version, changed executable files, and signer identity before installation.
  8. Separate update checking from business operations so a routine paid request cannot silently alter its own execution path immediately before submission.
  9. Add tests confirming that unsigned, incorrectly signed, downgraded, cross-channel, and cross-package releases are rejected.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (45)

Context-Inappropriate Capability

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

The scope includes wallet:spend plus unrelated capabilities such as image, video, speech, and voice operations, which are not justified by a coworking background-music playlist skill. Granting financial-spend authority and unrelated generation privileges creates a severe least-privilege violation and could enable unauthorized charges or broad account misuse if the token is later used maliciously.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s declared purpose does not suggest package removal or authentication lifecycle management, yet the referenced uninstall/disconnect behavior includes reading and modifying local filesystem state, revoking tokens, and removing local files. Embedding or linking destructive maintenance operations inside a benign content-creation skill increases the risk of accidental or covert state changes outside user expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s declared purpose does not suggest package removal or authentication lifecycle management, yet the referenced uninstall/disconnect behavior includes reading and modifying local filesystem state, revoking tokens, and removing local files. Embedding or linking destructive maintenance operations inside a benign content-creation skill increases the risk of accidental or covert state changes outside user expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill’s declared purpose does not suggest package removal or authentication lifecycle management, yet the referenced uninstall/disconnect behavior includes reading and modifying local filesystem state, revoking tokens, and removing local files. Embedding or linking destructive maintenance operations inside a benign content-creation skill increases the risk of accidental or covert state changes outside user expectations.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
Submit each slot once through bundled `scripts/mcp_client.py`. Poll

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
Submit each slot once through bundled `scripts/mcp_client.py`. Poll

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
Submit each slot once through bundled `scripts/mcp_client.py`. Poll

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
Submit each slot once through bundled `scripts/mcp_client.py`. Poll

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
Submit each slot once through bundled `scripts/mcp_client.py`. Poll

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md
Submit each slot once through bundled `scripts/mcp_client.py`. Poll

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
Submit each slot once through bundled `scripts/mcp_client.py`. Poll

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Automatic downloading, verification, and replacement of package-owned files is a software supply-chain capability that is not justified by the narrow business purpose of generating coworking background music. Even if update sources are described as fixed and verified, this materially increases attack surface: compromise of the update channel, client logic, or trust roots could result in silent code execution or persistence on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Financial account access is unjustified for a coworking background-music playlist skill because the declared business purpose has no apparent need to read balances or ledger activity. Even if the calls are read-only, they expose sensitive financial metadata and create an opportunity for privacy violations, profiling, or future abuse.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Referencing ~/.beatra/credentials.json indicates the skill depends on locally stored bearer credentials, which are sensitive secrets. In the context of an unrelated playlist skill, this is especially dangerous because it expands trust to a remote service and may enable access to account data or other MCP actions if the credentials are overprivileged.

Content

Scanner excerpt · manifest.json (reported line 53)May include surrounding context.

json
},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The authorization helper requests a very broad OAuth scope set that extends far beyond the skill’s stated purpose of producing a daytime office music playlist. Over-scoped tokens increase blast radius: if the credential is abused or the skill is compromised, an attacker could use unrelated Beatra capabilities under the user’s account.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file contains extensive self-update, package management, installation-state, and telemetry logic that is unrelated to the declared purpose of generating low-stimulation office music playlists. This expands the skill's trust boundary to include remote code/package delivery and persistent local state modification, creating supply-chain and stealth-behavior risk that is especially suspicious in a content-generation skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill performs best-effort installation telemetry and writes a local inventory of installed skills, behavior unrelated to music playlist creation. In this context, such persistence and reporting are more dangerous because they create covert tracking and system-mapping capabilities in a package whose advertised function gives users no reason to expect them.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

The exposed self-update command enables the package to replace its own installed files, which is a self-modification capability inappropriate for the stated playlist-generation function. Self-modifying code materially increases supply-chain risk and complicates user trust, incident response, and change control, even if transport and checksums are validated.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",