T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/authorize.py:32- Finding
Overprivileged Device Token and Unrestricted MCP Tool Forwarding
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill’s stated purpose is to generate fund factsheet page images from user-supplied content. Its legitimate runtime needs are therefore limited to image generation and editing, reference-file upload, model discovery, task status operations, and narrowly scoped wallet reads. The requested bearer-token scope also authorizes unrelated capabilities, including: - Video, music, and speech generation - Voice reads and writes - Broad artifact reads and writes - Wallet spending - Task cancellation In addition, `_run_command` accepts an arbitrary MCP tool name from the command line and forwards it to the remote endpoint. It does not enforce a package-specific allowlist matching the operations documented in `SKILL.md`. The remote server may still apply its own ...[truncated 1337 chars]- Remediation
View remediation