Grid Notice Voice Pack

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:18 AM UTC
• Version: 0.1.2

Overview

This looks like a real Beatra voice-clip skill, but it requests broad account powers and silently self-updates package code and instructions.

Review this before installing. Use it only if you are comfortable granting Beatra broad device-token access, billable generation authority, task/artifact access, local hostname/platform registration, and default silent package updates. Consider disabling auto-updates with the provided command and revoke the device in Beatra Console if you no longer trust the installation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Default-On Silent Retrieval and Replacement of Executable Package Files

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( install_root ...[truncated 3147 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:34

Finding

Speech-Only Skill Requests Broad Multimedia and Account-Impacting Privileges

Content

View full analysis

dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The declared Skill functionality requires text-to-speech generation and, when explicitly requested, voice cloning and sample upload. It also reasonably needs model and voice discovery, task status access, and limited wallet reads. The requested authorization additionally includes image, video, and music generation, general spending, wallet write access, and task cancellation. These capabilities are not required to produce grid-notice voice clips. The local client compounds this excessive ...[truncated 1514 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/authorize.py:345

Finding

Authorization Collects and Transmits Hostname and Agent-Environment Metadata

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" ``` It also reads the system hostname: ```python def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The collected values are included in the authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: ...[truncated 2000 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:1044

Finding

Windows Bearer-Token Permissions Are Assumed Rather Than Enforced

Content

View full analysis

str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` Credential creation only applies explicit permission modes on POSIX: ```python def _private_directory(path: Path) -> None: path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` ### Technical Analysis On POSIX systems, the implementation verifies ownership and exact `0700`/`0600` permissions before reading the bearer token. On Windows, it assumes that inherited profile ACLs are private and neither creates an explicit current-user-only discretionary ACL nor validates the effective ACL before reading the token. Default profile ACLs may be adequate on normally configured systems, but they are not guaranteed. Enterprise policy, migrated profiles, shared workstations, manually altered ACL inheritance, backup software, or installation under an unusual home path can make the state directory readable by additional local principals. This conflicts with the documentation’s claim that the current user ...[truncated 1068 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (46)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Broad MCP tool use, artifact read/write, and task read/cancel capabilities are not justified by a simple voice-clip generation workflow. In this skill context, those permissions could expose unrelated user data, enable modification of stored outputs, or interfere with other account tasks if the token is abused.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as producing notice audio, yet it also references uninstall/disconnect behavior, inventory inspection, revocation endpoints, and deletion of local credential/state files. Bundling lifecycle-management operations into a content-production skill expands the blast radius: misuse or prompt confusion could affect installed packages and authentication state rather than only generating clips.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as producing notice audio, yet it also references uninstall/disconnect behavior, inventory inspection, revocation endpoints, and deletion of local credential/state files. Bundling lifecycle-management operations into a content-production skill expands the blast radius: misuse or prompt confusion could affect installed packages and authentication state rather than only generating clips.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as producing notice audio, yet it also references uninstall/disconnect behavior, inventory inspection, revocation endpoints, and deletion of local credential/state files. Bundling lifecycle-management operations into a content-production skill expands the blast radius: misuse or prompt confusion could affect installed packages and authentication state rather than only generating clips.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

(`scripts/mcp_client.py` / `beatra.assets.upload`). Keep the returned

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

(`scripts/mcp_client.py` / `beatra.assets.upload`). Keep the returned

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

(`scripts/mcp_client.py` / `beatra.assets.upload`). Keep the returned

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

(`scripts/mcp_client.py` / `beatra.assets.upload`). Keep the returned

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

(`scripts/mcp_client.py` / `beatra.assets.upload`). Keep the returned

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md

(`scripts/mcp_client.py` / `beatra.assets.upload`). Keep the returned

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md

(`scripts/mcp_client.py` / `beatra.assets.upload`). Keep the returned

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md

(`scripts/mcp_client.py` / `beatra.assets.upload`). Keep the returned

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The manifest explicitly points the skill at a local bearer-token credential file, which indicates the skill can access reusable authentication material for the remote MCP service. If the skill runtime exposes file access or propagates these credentials too broadly, compromise of the skill or misuse of MCP calls could lead to unauthorized access to the user's account or linked backend resources.

Content

Scanner excerpt · manifest.json (reported line 53)May include surrounding context.

json

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The OAuth scope string requests a very broad set of privileges, including MCP tools, artifact access, task control, multiple media-generation capabilities, and voice write access, while the skill is described only as converting written grid notices into voice clips. Overbroad authorization violates least privilege and would let a compromised or misused skill act far beyond its stated purpose using the user's Beatra account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Broad MCP tool use, artifact read/write, and task read/cancel capabilities are not justified by a simple voice-clip generation workflow. In this skill context, those permissions could expose unrelated user data, enable modification of stored outputs, or interfere with other account tasks if the token is abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Broad MCP tool use, artifact read/write, and task read/cancel capabilities are not justified by a simple voice-clip generation workflow. In this skill context, those permissions could expose unrelated user data, enable modification of stored outputs, or interfere with other account tasks if the token is abused.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill includes a full self-update and package-management subsystem that downloads manifests and archives from remote infrastructure and rewrites the local installation, even though the declared function is only grid-notice voice generation. Although the updater contains several integrity checks, this is still materially broader authority than users would expect from a voice-clip skill and creates a supply-chain compromise path: if the vendor infrastructure, signing/checksum workflow, or release channel is abused, arbitrary package code can be replaced locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Session.request path supports generic MCP method invocation and tool calling, and the CLI exposes arbitrary 'call' execution with tool names and JSON arguments from stdin. This is much broader than a narrowly scoped voice skill and effectively turns the package into a generic remote capability wrapper; if misused or paired with over-privileged backend tools, it can perform actions unrelated to voice generation and expand the attack surface substantially.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This uninstall script performs security-sensitive actions unrelated to the advertised purpose of generating voice clips: it contacts a remote OAuth revocation endpoint and participates in lifecycle management of a shared device credential. Even if legitimate for package cleanup, this creates a capability mismatch where installing a seemingly audio-focused skill also grants code that can affect account/device authorization state.

Content

No source excerpt is available for this finding.