Geography Place Talking Clips

• Outcome: Review
• Latest audit: Sep 6, 2026 · 2:30 PM UTC
• Version: 0.1.2

Overview

The skill fits a Beatra geography video workflow, but it needs Review because it stores a broad shared Beatra credential and silently replaces its own executable package files by default.

Install only if you trust Beatra with a shared device credential that can access several media and account capabilities, and consider disabling automatic updates with the documented update --auto off command so package code is not replaced silently during normal use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/authorize.py:33
• Finding: Authorization Token Grants Capabilities Beyond the Skill's Functional Requirements<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:33-37` **Vulnerability Type**: Excessive authorization scope and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ### Technical Analysis The Skill's declared purpose is to upload authorized media, optionally clone a voice, synthesize speech, and produce image-to-video geography clips. It therefore legitimately requires access to artifacts, speech generation, voice operations, video generation, model or tool discovery, and task status operations. However, the requested Device Token also grants unrelated capabilities, including: - `images:generate` - `music:generate` - General `wallet:spend` - Broad artifact and task access - General task cancellation Image generation and music generation are not required by the documented geography talking-clip workflow. Moreover, the token is shared across installed Beatra Skills rather than being restricted to this package and its resources. This increases the authorization boundary substantially beyond the minimum privileges needed by the Skill. The credential-file access itself is legitimate and appropriately protected on POSIX systems. The issue is the breadth of the server-side permissions represented by the token, not the fact that the client reads it. ### Attack Path 1. An attacker obtains code execution in this Skill, a future remotely installed version of it, or another local component able to read the shared credential. 2. The attacker reads the full-scope bearer token from `~/.beatra/credentials.json`. 3. The attacker sends authenticated requests to `https://mcp.beatra.ai/mcp`. 4. The token is used to perform operations outside this Skill's declared workflow, such as image generation, music generation, wallet ...[truncated 746 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Issue a package-specific token rather than reusing one full-scope Device Token across all Beatra Skills. 2. Remove capabilities unrelated to this workflow, particularly: - `images:generate` - `music:generate` 3. Restrict `wallet:spend` to approved operations, package identities, and user-confirmed request IDs. 4. Scope artifact and task access to resources created by this package or the current workflow. 5. Restrict task cancellation to tasks created by this package. 6. Request additional permissions through explicit incremental authorization only when a user selects a feature that requires them. 7. Display the exact requested capabilities on the device-authorization page so the user can make an informed decision. 8. Add automated tests that compare the authorization scope against the MCP tools actually invoked by the Skill. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/mcp_client.py:969
• Finding: Silent Automatic Updates Permit Remote Replacement of Executable Skill Code<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/mcp_client.py:31-32` - `scripts/mcp_client.py:334-356` - `scripts/mcp_client.py:469-490` - `scripts/mcp_client.py:969-1019` - `scripts/mcp_client.py:1542-1544` - `SKILL.md:233-253` **Vulnerability Type**: Remote payload retrieval and execution through automatic self-update **Risk Level**: Medium ### Vulnerable Code The update locations are remotely controlled vendor endpoints: ```python PACKAGE_DISCOVERY_URL = "https://beatra.ai/skills/geo-place-talking/channels/clawhub/install.json" PACKAGE_CDN_BASE_TEMPLATE = "https://cdn.beatra.ai/agent-packages/geo-place-talking/channels/clawhub/v{version}" ``` The complete automatic-update routine downloads and installs an available update without separate confirmation: ```python def maybe_auto_update( *, state_dir: Path | None = None, install_root: Path | None = None, get_bytes: GetBytes = _default_get_bytes, now: float | None = None, ) -> bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _ ...[truncated 4144 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic installation by default. Make automatic update checks opt-in, or check silently but require explicit approval before replacing files. 2. Verify update metadata with a digital signature anchored in an offline public key embedded in the reviewed package. 3. Use a signed update framework that provides: - Root-key rotation. - Expiring metadata. - Threshold signatures. - Version rollback protection. - Protection against freeze and mix-and-match attacks. 4. Keep release-signing authority separate from discovery and CDN hosting infrastructure. 5. Display the target version, changelog, changed files, and signer identity before installation. 6. Pin or independently verify the initial trusted release metadata instead of deriving all trust from the live discovery response. 7. Preserve the existing archive, path, size, ownership, symlink, locking, transaction, and rollback protections. 8. Treat update failures as visible security events rather than suppressing all exceptions silently; report a concise diagnostic without blocking the requested MCP operation. 9. Consider executing updates through a dedicated, minimally privileged updater that cannot access the bearer token. 10. Add release transparency or an append-only public log so unauthorized package versions can be detected. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares itself as a media-generation workflow but instructs the host to use shell, file access, network access, and local state without any declared permission boundary. That creates a hidden capability expansion: a user invoking a seemingly narrow content skill may cause local file inspection/upload, credential handling, and remote operations that exceed the stated trust model.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior materially exceeds the declared purpose by including OAuth login, persistent credential storage, generic remote MCP invocation, uploads, telemetry/registration, uninstall behavior, and self-update logic. Description-behavior mismatch is dangerous because it prevents informed consent and can trick users or host agents into granting broad operational trust to a skill that appears narrowly scoped.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill includes automatic self-updating that downloads and installs newer releases, which is a software supply-chain behavior not implied by a clip-generation skill. Even if verification is claimed, self-modifying behavior increases attack surface and makes future behavior differ from what was reviewed at install time.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Automatic downloading, verification, and replacement of package files gives the skill a self-modifying capability unrelated to its stated media task. That is dangerous because compromise of the update path, validation implementation, or package ownership assumptions could turn a content workflow into arbitrary code delivery with the host's privileges.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The changelog mentions balance, ledger, top-up, tier pricing, and addresses that are unrelated to a geography video skill, which is a strong signal of copied or hidden financial capability. Even if these features are not exposed in this manifest, the mismatch undermines trust, suggests undeclared behavior in the linked skill content or MCP usage, and could mislead reviewers about the skill’s true scope.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This documentation introduces a bundled client auto-update mechanism that is unrelated to the stated purpose of generating geography talking clips. In a skill package, unrelated updater behavior expands the trust boundary and can normalize software modification capabilities that users would not reasonably expect from a media-generation skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file describes silent automatic installation of newer releases by default, without separate confirmation, before ordinary commands. Even with integrity checks, silent self-modifying behavior creates a supply-chain and user-consent risk because the skill can change code on the user's system outside the expected media-generation workflow.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The wording emphasizes that the check is silent and does not interrupt requested work, while also stating that update activity occurs before ordinary commands. This framing can downplay the fact that executable files may be replaced as part of routine usage, reducing informed consent and making unexpected system changes easier to hide.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The authorization helper requests a very broad OAuth scope set that materially exceeds the stated purpose of generating geography place talking clips. In particular, artifacts read/write, tasks cancel/read, image/music/voice capabilities, and wallet spending create unnecessary privilege that increases blast radius if the credential is abused, stolen, or reused by other components.

Context-Inappropriate Capability

Critical

• Confidence: 97% confidence
• Finding: The scope list includes voice-management and music-generation permissions that do not align with a one-photo, one geography place talking clip workflow. Overbroad media and account-management permissions enlarge the attack surface and enable misuse beyond the skill's declared function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The scope list includes voice-management and music-generation permissions that do not align with a one-photo, one geography place talking clip workflow. Overbroad media and account-management permissions enlarge the attack surface and enable misuse beyond the skill's declared function.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The client contains extensive self-update and installation-management logic unrelated to the stated geography clip generation function. That greatly expands the attack surface: the skill can download, validate, and replace its own installed files, so any compromise of the update channel, publisher account, or trust root turns a media workflow skill into a software deployment mechanism.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill records local inventory in ~/.beatra/skills.json and sends installation registration telemetry to a remote service, which goes beyond the declared clip-generation purpose. While not directly destructive, this creates unnecessary privacy and tracking risk, especially when coupled with persistent installation identifiers and recurring background registration behavior.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fingerprints the execution environment using environment variables and host.json, then attaches source_platform attribution to tool calls and registration events. For a geography talking-clip skill, this is unrelated to core function and increases privacy sensitivity by enabling environment classification and cross-install correlation.

Vague Triggers

Medium

• Confidence: 71% confidence
• Finding: The manifest description uses broad, generic wording that does not clearly constrain when the skill should be invoked, increasing the chance it is triggered for loosely related requests. Over-broad activation can cause unnecessary access to user-supplied media, place tables, and connected MCP resources outside the user’s intended context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The markdown states that silent automatic updates are enabled by default but does not give a prominent user warning that local package files may be replaced automatically. In the context of a geography media skill, this is especially unjustified because users would not expect autonomous file replacement as part of clip generation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document describes automatic installation registration to an external service and creation of a local cache file, but it does not explicitly warn users that metadata is transmitted and a file is written on first use. Even if the data is described as non-secret and non-billable, this is still telemetry-like behavior that can surprise users, create privacy concerns, and violate expectations in sensitive environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: maybe_auto_update() performs silent best-effort updates during normal command execution and can modify installed package files without a user-facing prompt at runtime. In skill context this is especially dangerous because ordinary use of a benign media tool can trigger code replacement, reducing user awareness and making malicious or compromised updates harder to detect.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

• Confidence: 95% confidence
• Finding: The manifest declares use of a local credential file at ~/.beatra/credentials.json for device-bearer authentication, which indicates the skill depends on sensitive bearer credentials accessible from the host environment. If the skill or connected MCP actions are over-privileged, compromised, or invoked unexpectedly, these credentials could authorize account actions or data access beyond simple media generation.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The exposed self-update command confirms that the skill is designed to modify its own installed code. Self-modifying behavior is high risk in an agent skill because it creates a built-in pathway for post-installation code changes that may bypass host review expectations and can be abused if the vendor infrastructure or release process is compromised.

Static analysis

No suspicious patterns detected.