T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Over-Privileged Device Authorization and Unrestricted MCP Tool Dispatch
- Content
View full analysis
- Remediation
View remediation
Security audit
Credit Rights Voice Pack
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its voice-pack purpose, but it also asks for broad Beatra account powers and silently installs package updates, so it needs review before installation.
Install only if you are comfortable giving this Beatra package a shared account token with broad media, artifact, task, and spending capabilities. Disable automatic updates before use if you need reviewed code to stay fixed, and be careful with staff voice samples because uploads depend on destinations returned by the Beatra service.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:969- Finding
Silent Automatic Retrieval and Installation of Mutable Remote Code
- Content
View full analysis
bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( install_root=resolved_root, ...[truncated 3043 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:241- Finding
Local File Upload Grants Permit Arbitrary HTTPS Destination Hosts
- Content
View full analysis
- Remediation
View remediation
other
Note
- Location
scripts/authorize.py:362- Finding
Collection and Transmission of Hostname and Persistent Environment Telemetry
- Content
View full analysis
str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEVICE_AUTHORIZATION_URL, form) ``` ```python result = session.request( 2, "tools/call", { "name": "beatra.installations.register", "arguments": { "package_slug": PACKAGE_SLUG, "package_version": PACKAGE_VERSION, "platform": host_platform(state_dir), "external_installation_ref": _registration_reference(state_dir), }, }, timeout=REGISTRATION_TIMEOUT_SECONDS, ) ``` Platform detection also inspects agent-specific environment signatures: ```python env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() ``` ### Technical Analysis The authorization helper reads the machine hostname and sends it to the Beatra authorization service as `device_name`. It also identifies the agent environment from selected process-environment signatures. R ...[truncated 1657 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (46)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Granting mcp:tools, tasks:read, tasks:cancel, and broad artifact permissions gives the skill generalized operational control outside its narrow table-to-voice purpose. In context, that makes the package much more dangerous because a user authorizing a simple voice skill would not reasonably expect broad tool and task authority.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The references indicate the package can perform uninstall/disconnect behavior, inspect shared installation state, manipulate files under
~/.beatra, and potentially revoke tokens over the network, none of which is implied by a simple audio-pack skill. Administrative lifecycle operations bundled into the same trust envelope make accidental or malicious misuse more damaging.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The references indicate the package can perform uninstall/disconnect behavior, inspect shared installation state, manipulate files under
~/.beatra, and potentially revoke tokens over the network, none of which is implied by a simple audio-pack skill. Administrative lifecycle operations bundled into the same trust envelope make accidental or malicious misuse more damaging.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The references indicate the package can perform uninstall/disconnect behavior, inspect shared installation state, manipulate files under
~/.beatra, and potentially revoke tokens over the network, none of which is implied by a simple audio-pack skill. Administrative lifecycle operations bundled into the same trust envelope make accidental or malicious misuse more damaging.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Allowing automatic remote update checks, downloads, verification, and installation is not justified by the stated skill purpose and materially increases supply-chain exposure. Even with signature checks, silent code replacement changes what the skill can do after approval and can be abused if the update channel or trust root is compromised.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The explicit use of a credential file containing bearer authentication is a real credential-exposure and over-privilege concern. Bearer tokens grant access to whoever can read or misuse them, and a content-generation skill with a narrow stated function should not need broad reusable account credentials without strong justification.
- Content
json }, "mcp": { "authentication": "device-bearer", "credential_file": "~/.beatra/credentials.json", "name": "beatra", "transport": "streamable-http", "url": "https://mcp.beatra.ai/mcp"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file documents a self-updating client that checks for releases, downloads packages, and replaces installed files, which is unrelated to the declared credit-rights voice-clip functionality. In a skill whose stated purpose is audio generation, hidden or extraneous update/install behavior materially increases attack surface and suggests the package may perform privileged local state changes beyond user expectations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly states that the client silently checks for updates and automatically installs them without separate confirmation. For a voice studio skill, unsolicited downloading and replacement of local package files is an unjustified capability that could enable unexpected code changes, persistence, or compromise if the update channel or implementation is ever abused.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The OAuth scope bundle grants far more authority than a voice-clip skill needs, including generic MCP tools, artifact access, media generation, task control, and wallet spending. This violates least privilege and means authorizing the skill effectively gives it a broad account token that could be abused if the skill code, package, or downstream service is compromised.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Granting mcp:tools, tasks:read, tasks:cancel, and broad artifact permissions gives the skill generalized operational control outside its narrow table-to-voice purpose. In context, that makes the package much more dangerous because a user authorizing a simple voice skill would not reasonably expect broad tool and task authority.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Granting mcp:tools, tasks:read, tasks:cancel, and broad artifact permissions gives the skill generalized operational control outside its narrow table-to-voice purpose. In context, that makes the package much more dangerous because a user authorizing a simple voice skill would not reasonably expect broad tool and task authority.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 77% confidence
- Finding
This code writes a long-lived bearer access token to credentials.json on disk. Although it uses restrictive permissions, the token embodies the overly broad scopes requested by the skill, so any local compromise of the file yields extensive account capabilities beyond the skill's advertised purpose.
- Content
python scope = _required_string(polled, "scope") if set(scope.split()) != set(SCOPE.split()): raise RuntimeError("Beatra authorization returned an unsupported scope") credential_path = state_dir / "credentials.json" _atomic_json( credential_path, {
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The client contains substantial behavior unrelated to its stated voice-pack purpose: package self-update, installation registration, and local inventory tracking. This violates least functionality and expands the trust boundary, meaning a skill ostensibly for audio generation can modify its own codebase and transmit installation metadata, increasing the blast radius if the vendor endpoint or update channel is compromised.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill writes a local inventory of installed skills and sends installation registration telemetry that is unrelated to generating voice clips. This introduces persistent tracking and cross-skill visibility on the host, which can reveal user activity and expand the consequences of compromise beyond this single package.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The exposed self-update capability enables the package to replace its own installed files, which is a self-modifying behavior atypical for the declared voice-clip function. In skill context, this is more dangerous because the package can evolve into materially different code after installation, creating a supply-chain and persistence risk if the update source, manifests, or operator trust are ever compromised.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The uninstall script is tightly coupled to shared Beatra device credentials and remote revocation logic, which is unrelated to the declared skill purpose of generating credit-rights voice clips. A skill whose advertised function is content generation should not need to inspect shared skill inventory or manage cross-skill authentication state, making this a strong indicator of hidden platform-control behavior.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script enumerates and later deletes files in a shared ~/.beatra state directory, including credentials, installation metadata, host configuration, and registrations. For a skill described as converting a benefits table into audio clips, access to shared platform state is unnecessary and dangerous because it gives the package influence over other skills’ connectivity and local authorization material.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Referencing credentials.json as part of the set of files the skill may remove indicates awareness of and intended interaction with stored authentication material. In the context of a voice-generation skill, any credential access is highly suspicious because it expands the skill’s scope into privileged account and device control.
- Content
python #: these and then removes the directory only if it is empty — the script #: never recursively deletes a directory it does not fully understand. _STATE_FILES = ( "credentials.json", "installation.json", "host.json", "skills.json",
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code performs an authenticated network request to revoke a device token at a central API endpoint. That is a privileged action affecting the device’s shared authorization state, and it is not justified by the skill’s advertised voice-pack workflow; if triggered unexpectedly, it could disrupt all other installed skills using the same connection.
- Content