Duty Board Pack

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:21 AM UTC
• Version: 0.1.2

Overview

The skill’s classroom image workflow is understandable, but it asks for broad account authority and can silently replace its own executable package files after installation.

Install only if you are comfortable giving this Beatra package a broad shared device token, allowing generic Beatra tool calls through its bundled client, and accepting default silent package updates. Before use, consider disabling automatic updates with the documented `update --auto off` control and review the Beatra approval page and account console carefully.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Default Silent Retrieval and Replacement of Executable Package Files

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] mani ...[truncated 2907 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:31

Finding

OAuth Credential Requests Permissions Beyond Duty-Board Generation

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: scripts/authorize.py:339

Finding

Hostname, Agent Platform, and Stable Installation Identifier Are Collected and Transmitted

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The values are added to the authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, ...[truncated 1950 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:1465

Finding

Generic MCP Dispatch Is Not Restricted to Duty-Board Tools

Content

View full analysis

dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` The parser accepts an arbitrary tool name: ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The client accepts any caller-supplied MCP tool name and forwards it with an arbitrary JSON object. It does not enforce a package-specific allowlist or local argument schema. This is especially significant because the associated bearer credential requests generic MCP, spending, artifact, voice, media-generation, and task-cancellation scopes. Server-side authorization remains an important control, but the client exposes every server tool available to the token rather than limiting operations to the Skill's declared image workflow. A manipulated agent instruction or operator mistake can therefore invoke unrelated functionality through a legitimate-looking bundled command. ### Attack Path 1. The Skill obtains the broad bearer token. 2. A malic ...[truncated 828 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:1044

Finding

Windows Bearer-Credential ACL Is Assumed Rather Than Verified

Content

View full analysis

str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") if os.name != "posix": raise RuntimeError("Beatra credential permissions are unsupported on this platform") ``` The authorization helper similarly applies permissions only on POSIX: ```python def _private_directory(path: Path) -> None: path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` ### Technical Analysis On POSIX systems, the client verifies directory ownership, mode `0700`, file ownership, mode `0600`, regular-file status, and resistance to symlink traversal. On Windows, it assumes that the user-profile ACL is private and reads the bearer credential without inspecting the effective discretionary access-control list. That assumption can be invalid when profile permissions have been inherited, modified by administrators or applications, migrated from another system, or placed on a filesystem with nonstandard ACL behavior. The token is powerful and shared across package workflows, so confidentiality should not depend solely on a defaul ...[truncated 1140 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (42)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The requested permissions include voice, speech, music, and video generation, which are unrelated to producing four-to-eight still duty board images. These unnecessary capabilities enlarge the attack surface and allow misuse of the token for unrelated content generation if credentials are compromised or backend behavior is abused.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a classroom graphics tool but also references uninstall/disconnect functionality that reads shared installation state, inspects installed skills, revokes tokens over the network, and deletes local state files. Bundling lifecycle-management actions into a narrowly described content skill makes destructive or privacy-sensitive operations less visible and therefore more likely to be approved without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a classroom graphics tool but also references uninstall/disconnect functionality that reads shared installation state, inspects installed skills, revokes tokens over the network, and deletes local state files. Bundling lifecycle-management actions into a narrowly described content skill makes destructive or privacy-sensitive operations less visible and therefore more likely to be approved without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a classroom graphics tool but also references uninstall/disconnect functionality that reads shared installation state, inspects installed skills, revokes tokens over the network, and deletes local state files. Bundling lifecycle-management actions into a narrowly described content skill makes destructive or privacy-sensitive operations less visible and therefore more likely to be approved without informed consent.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

Submit once through bundled `scripts/mcp_client.py`. Poll

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

Submit once through bundled `scripts/mcp_client.py`. Poll

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

Submit once through bundled `scripts/mcp_client.py`. Poll

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

Submit once through bundled `scripts/mcp_client.py`. Poll

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

Submit once through bundled `scripts/mcp_client.py`. Poll

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

Submit once through bundled `scripts/mcp_client.py`. Poll

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md

Submit once through bundled `scripts/mcp_client.py`. Poll

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Referencing a local credentials file gives the skill a path to sensitive authentication material unrelated to its stated classroom-board purpose. In this context, access to ~/.beatra/credentials.json is especially dangerous because it can enable account compromise, unauthorized API use, or silent exfiltration through the configured remote MCP endpoint.

Content

Scanner excerpt · manifest.json (reported line 53)May include surrounding context.

json

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The OAuth scope string requests a very broad set of capabilities, including images, videos, music, speech, voices, task control, artifact access, and wallet spending, which is far beyond what a classroom duty-board still generator should need. Over-scoped credentials violate least privilege and greatly increase blast radius if the token is abused, leaked, or the skill behavior changes unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The requested permissions include voice, speech, music, and video generation, which are unrelated to producing four-to-eight still duty board images. These unnecessary capabilities enlarge the attack surface and allow misuse of the token for unrelated content generation if credentials are compromised or backend behavior is abused.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements a broad remote-control client with authenticated MCP access, arbitrary tool invocation, file upload, telemetry, and package update logic that materially exceeds the declared classroom duty-board generation purpose. In a skill expected to transform user roster data into images, this hidden capability expansion increases the attack surface and enables remote behaviors unrelated to the user-visible function, which is especially risky because it handles credentials and network actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill can fetch remote manifests and archives and then replace installed local package files, including silent best-effort auto-update behavior. Even with integrity checks, this introduces a self-modifying execution path unrelated to the declared board-generation purpose, allowing remote code changes after installation and increasing supply-chain risk if the update channel or signing assumptions fail.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The command runner exposes a general-purpose tool invocation surface that reads arbitrary JSON arguments from stdin and forwards them to remote tools by name. For a narrowly scoped classroom graphics skill, this is unnecessary capability expansion that could be abused to invoke backend actions outside the expected duty-board workflow.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The explicit self-update command advertises and enables modification of the installed package from remote content, making the skill self-modifying. In a narrowly scoped classroom-duty content skill, self-modification is unjustified and materially raises supply-chain and post-installation code-change risk beyond what users would reasonably expect.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",