T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Device Token Grants Capabilities Beyond the Skill’s Declared Function
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared Skill function is to create ecommerce product-detail images. Its legitimate requirements include product-image uploads, image transformation, model discovery, task reads, and user-requested task cancellation. The requested bearer-token scope additionally grants video, music, speech, voice creation, voice reading, voice writing, and wallet-spending permissions. These capabilities are not necessary for the declared image-focused workflow. The same full-scope token is shared among Beatra Skills and is accepted by a generic command that does not enforce a package-specific allowlist of MCP tools. This violates least privilege. Even if the rem ...[truncated 1336 chars]- Remediation
View remediation