T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/authorize.py:34
- Finding
- Device token grants capabilities beyond the Skill's legitimate requirements<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:34-37`; related generic tool execution at `scripts/mcp_client.py:1463-1482` **Vulnerability Type**: Excessive authorization scope and missing client-side tool restriction **Risk Level**: Medium ### Complete Code Snippet ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` The bundled client also accepts an arbitrary tool name: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared elder-checkup workflow requires speech synthesis, optional voice cloning, voice and model discovery, artifact upload, task inspection, and billing-related operations. The authorization scope additionally grants unrelated image, video, and music generation capabilities, general wallet spending, artifact and task access, and task cancellation. This violates least privilege because compromise or misuse of the shared bearer token would expose capabilities unrelated to producing elder-checkup audio. The risk is amplified by the generic `call` command, which does not enforce a package-specific allowlist and forwards any supplied tool name to ...[truncated 1604 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope credential with a package-specific, least-privilege token. 2. Remove unrelated scopes, particularly: - `images:generate` - `videos:generate` - `music:generate` - Broad cancellation or spending permissions not strictly required by this Skill 3. Separate wallet inspection from wallet spending and request only the minimum billing permission needed for approved speech or clone submissions. 4. Enforce a local allowlist in `scripts/mcp_client.py`. For this Skill, permit only explicitly required tools such as model and voice discovery, speech synthesis, optional voice cloning, artifact upload, task inspection, wallet inspection, and installation registration. 5. Reject every tool name outside that allowlist before any network request. 6. Use server-side audience or package restrictions so the token cannot call unrelated tools even if the local client is modified. 7. Display the exact requested capabilities on the authorization page and require a new approval when capabilities materially expand. 8. Consider issuing short-lived access tokens with securely rotated refresh credentials rather than a broad bearer token with a sliding 15-day lifetime. ]]>