T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:31- Finding
Excessive OAuth Scope and Unrestricted MCP Tool Dispatch
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill's declared functionality is elder-checkup voice production, including text-to-speech, optional voice cloning, media upload, model and voice lookup, task retrieval, and limited billing operations. However, the authorization request includes permissions for unrelated image, video, and music generation, general wallet spending, artifact access, and task cancellation. The bundled MCP client also accepts an arbitrary tool name from the command line and forwards it to the remote MCP server without enforcing a package-specific allowlist. Consequently, local safety depends entirely on the bearer token's broad server-side permissions and on higher-level instructions being followed correctly. T ...[truncated 1656 chars]- Remediation
View remediation