T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:35
- Finding
- Overprivileged Shared Credential with Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:35-38`; `scripts/mcp_client.py:1465-1479` **Vulnerability Type**: Excessive authorization scope and unrestricted privileged tool invocation **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared avatar workflow requires artifact upload and retrieval, model discovery, voice cloning or selection, speech generation, video generation, and task management. The requested credential also grants unrelated image generation, music generation, broad wallet spending, and access to shared task and artifact operations. The client accepts an arbitrary `tool_name` from the command line and forwards it to the authenticated MCP endpoint without a package-specific allowlist. Consequently, the broad bearer credential—not the declared Skill workflow—becomes the effective authorization boundary. The credential is shared across Beatra Skills, which further enlarges the blast radius. A local process or manipulated agent capable of invoking the bundled client can exercise every tool permitted by the token, including capabilities unrelated to founder-avatar generation. ### Attack Path 1. An attacker obtains the ability to influence commands executed in the Skill context, or another local process invokes the bundled client. 2. The attacker supplies an arbitrary MCP tool nam ...[truncated 882 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope credential with a package-specific credential restricted to the precise tools required by this workflow. 2. Remove unrelated scopes such as `images:generate` and `music:generate`. 3. Separate read-only wallet access from spending authorization and request spending capability only immediately before an explicitly approved billable operation. 4. Add a local allowlist for valid MCP tool names. Reject every tool not required by the documented workflow. 5. Apply server-side package and installation restrictions rather than trusting client-supplied source attribution. 6. Isolate artifacts and tasks by package or tenant so one Skill cannot inspect or cancel another Skill's work. 7. Require explicit confirmation for every operation that can spend credits or cancel work, even if the caller invokes the generic client directly. ]]>