T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:33- Finding
Overprivileged OAuth Scope Combined with Unrestricted MCP Tool Dispatch
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The declared purpose of this Skill is to generate, transform, and edit Douyin cover images. Its minimum legitimate permissions therefore concern image operations, selected artifact uploads, and associated task management. The requested token additionally grants: - Video generation - Music generation - Speech generation - Voice read and write access - Wallet spending - Gene ...[truncated 1742 chars]- Remediation
View remediation