T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/authorize.py:34- Finding
Authorization Requests Capabilities Beyond the Skill's Declared Image-Generation Purpose
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Ecommerce Listing Image Set
Security checks for vulnerabilities and agentic risk
Overview
The skill does the advertised image work, but it also requests and persists broader Beatra account powers than an ecommerce image skill needs.
Install only if you are comfortable giving this Beatra package a shared full-scope device credential and allowing default silent updates. Consider disabling auto-updates with the documented command and revoking the device from the Beatra Console when you no longer need the skill.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:1044- Finding
Windows Credential File Confidentiality Is Assumed but Not Enforced
- Content
View full analysis
None: # POSIX gets explicit 700/600. On Windows the state directory lives under # the user profile, whose default ACL is already private to the user — # the same posture as gh/aws/gcloud credential stores. The former custom # DACL ceremony was dropped deliberately: its command patterns read as # hostile to agent safety policies and endpoint security, failing installs # while adding no protection an elevated administrator could not bypass. path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) ``` Credential loading in `scripts/mcp_client.py:1044-1051` does not validate Windows ACLs: ```python def _read_private_credentials(state_dir: Path, path: Path) -> str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` By contrast, the POSIX branch verifies directory ownership, exact `0700` directory permissions, file ownership, exact `0600` file permissions, regular-file status, and symlink resistance before reading the token. ### Technical Analysis The bearer token is stored in plaintext JSON at `~/.beatra/credentials.json`. Plaintext credential fil ...[truncated 2217 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (46)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The authorization scope includes voice, speech, music, and video generation even though the skill advertises only product listing image creation. These unrelated generative permissions unnecessarily enlarge what a stolen or abused token can do, including spending resources on additional media generation and accessing capabilities users would not reasonably expect to grant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's documented references include uninstalling local packages, deleting local state under ~/.beatra, inspecting installed skill inventory, revoking authorization, and managing shared device credentials—administrative lifecycle actions unrelated to generating listing images. Bundling these capabilities into a creative skill increases the chance of unintended destructive actions and makes abuse more impactful if the package or its client is compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's documented references include uninstalling local packages, deleting local state under ~/.beatra, inspecting installed skill inventory, revoking authorization, and managing shared device credentials—administrative lifecycle actions unrelated to generating listing images. Bundling these capabilities into a creative skill increases the chance of unintended destructive actions and makes abuse more impactful if the package or its client is compromised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's documented references include uninstalling local packages, deleting local state under ~/.beatra, inspecting installed skill inventory, revoking authorization, and managing shared device credentials—administrative lifecycle actions unrelated to generating listing images. Bundling these capabilities into a creative skill increases the chance of unintended destructive actions and makes abuse more impactful if the package or its client is compromised.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/mcp_client.py`. Put the MCP tool name after `call` and send one JSON
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/mcp_client.py`. Put the MCP tool name after `call` and send one JSON
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/mcp_client.py`. Put the MCP tool name after `call` and send one JSON
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/mcp_client.py`. Put the MCP tool name after `call` and send one JSON
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/mcp_client.py`. Put the MCP tool name after `call` and send one JSON
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/mcp_client.py`. Put the MCP tool name after `call` and send one JSON
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatic remote update and package replacement is unjustified in the context of an image-listing generation skill because it grants code replacement capability unrelated to the seller's task. This becomes especially dangerous when paired with shell, network, and file-write access, since a compromised update channel or logic flaw could alter local executable behavior without fresh review.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is described as an ecommerce listing image generator, but the requested OAuth scope includes many unrelated privileges such as videos:generate, music:generate, speech:generate, voices:read, voices:write, wallet:spend, tasks:read, tasks:cancel, and broad artifact access. This violates least privilege and materially expands blast radius: if the skill, its runtime, or stored token is abused, an attacker could invoke unrelated paid or sensitive platform capabilities far beyond image creation.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The authorization scope includes voice, speech, music, and video generation even though the skill advertises only product listing image creation. These unrelated generative permissions unnecessarily enlarge what a stolen or abused token can do, including spending resources on additional media generation and accessing capabilities users would not reasonably expect to grant.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The client contains broad non-core capabilities: silent self-update, installation registration, local skill inventory management, and generic remote MCP tool access. For a skill whose stated purpose is generating ecommerce listing images, these behaviors materially expand the trust boundary and create a supply-chain and remote-capability risk surface unrelated to the advertised function.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The CLI exposes generic tools/list and arbitrary tools/call functionality against the remote MCP endpoint, allowing the package to act as a general-purpose remote tool proxy rather than a narrowly scoped ecommerce image skill. In context, this is especially dangerous because it permits capability expansion beyond the declared purpose and could be used to invoke unrelated or sensitive backend actions if the account is authorized for them.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The package explicitly supports self-update and includes code paths that replace its own installed files. Self-modifying behavior is high risk in agent skills because it bypasses the expectation that reviewed code remains stable after installation; if the update channel or publisher is compromised, the skill can become a vehicle for malicious code delivery.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This uninstall script handles shared device authorization and calls a remote revocation endpoint even though the skill’s declared purpose is ecommerce image generation. That mismatch expands the skill’s operational scope into credential and device-management territory, increasing the risk of unexpected account disruption or abuse if the package is installed under a broader-trust model.
- Content
Static analysis
No suspicious patterns detected.