Hall Guide Voice Pack

• Outcome: Review
• Latest audit: Sep 6, 2026 · 2:35 PM UTC
• Version: 0.1.2

Overview

The skill performs the advertised voice-generation workflow, but it also stores a broad Beatra account token and silently self-updates executable package files by default.

Review this before installing if you need tight account scoping, locked-down software updates, or strict privacy controls. Use only if you are comfortable granting a shared Beatra device token with broad media and wallet capabilities, and consider disabling automatic updates with the documented update command after installation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969
• Finding: Default-Enabled Silent Remote Replacement of Executable Skill Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mcp_client.py:969-1023`, `scripts/mcp_client.py:1537-1539`; behavior is disclosed in `SKILL.md:183-203` and `references/automatic-updates-and-safety.md:3-19` **Vulnerability Type**: Silent remote code update channel **Risk Level**: High ### Vulnerable Code ```python def maybe_auto_update( *, state_dir: Path | None = None, install_root: Path | None = None, get_bytes: GetBytes = _default_get_bytes, now: float | None = None, ) -> bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get ...[truncated 3151 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic installation by default. Update checks may be automatic, but replacement must require explicit, informed user approval. 2. Display the current version, proposed version, release identity, and changed file list before installation. 3. Sign release manifests with a dedicated offline signing key and pin the corresponding public key in the audited client. 4. Verify signatures independently of the HTTPS/CDN trust domain; checksums supplied by the same release channel are insufficient as an independent authorization mechanism. 5. Require a fresh audit or trust decision before executing a changed `SKILL.md` or any changed script. 6. Separate update functionality from the credential-bearing MCP client so an updater does not need access to account credentials. 7. Preserve rollback and path-validation controls, as those controls correctly reduce archive traversal and partial-update risks. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:31
• Finding: Voice-Only Skill Requests Excessive Account-Wide Authorization Scopes<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:31-35`, used in the authorization request at `scripts/authorize.py:455-468` **Vulnerability Type**: Violation of least privilege **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` The full scope is included in the device-authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name ``` ### Technical Analysis The declared purpose is to generate hall-guide speech clips and, optionally, clone a voice from an authorized sample. That workflow may reasonably require speech generation, narrowly scoped voice read/write access, artifact upload, and task-status reads. The requested authorization additionally includes image generation, video generation, music generation, unrestricted wallet spending, and general task cancellation. Those permissions are not necessary for the declared hall-guide voice workflow. The token is also described as shared among installed Beatra Skills, increasing both its value and the consequences of compromise. This is a direct least-privilege failure: authorization encompasses unrelated paid capabilities instead of being constrained to the package and operations that the user selected. ### Attack Path 1. The user runs `scripts/authorize.py` to enable hall-guide speech generation. 2. The authorization request asks for the complete `SCOPE`, including unrelated media generation and wallet-spend permissions. ...[truncated 694 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the account-wide scope with a package-specific, least-privilege scope. 2. Remove `images:generate`, `videos:generate`, and `music:generate`. 3. Replace unrestricted `wallet:spend` with a narrowly constrained permission that is limited to explicitly confirmed speech or voice-clone operations. 4. Restrict task cancellation and task reads to tasks created by this package and installation. 5. Restrict artifact write/read permissions to artifacts created for the current workflow. 6. Separate read-only operations from paid operations and require per-stage user confirmation before granting or exercising paid permissions. 7. Avoid sharing a single broad bearer token among unrelated Skills; use package-bound credentials or capability tokens. 8. Enforce scope restrictions server-side, not solely through Skill instructions. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/mcp_client.py:1463
• Finding: Generic MCP Dispatcher Allows Invocation of Arbitrary Authorized Tools<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mcp_client.py:1463-1481`, command exposure at `scripts/mcp_client.py:1484-1500` **Vulnerability Type**: Unrestricted tool dispatch **Risk Level**: High ### Vulnerable Code ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` The CLI accepts an unrestricted tool name: ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The documented workflow names a limited collection of Beatra operations, but the bundled client does not enforce that list. Any string supplied as `tool_name` is forwarded to the remote MCP endpoint through `tools/call`. JSON-object validation prevents malformed stdin but does not constrain the selected operation or validate arguments against the Skill's declared purpose. Because the bearer credential has broad scopes, this generic dispatcher converts excessive authorization into directly reachable functionality. The issue does not require command injection or local shell execution. It is an authorization-boundary problem: a voice-oriented package exposes every remote tool accepted by the server and authorized by the shared token. ### Attack Path 1. The user authorizes the package, ...[truncated 876 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce a static allowlist of MCP tools required by the declared workflow. 2. Separate read-only tools, upload tools, and paid tools into distinct code paths. 3. Validate each tool's arguments locally against a strict schema. 4. Bind paid calls to a recent, explicit user confirmation and the exact approved arguments. 5. Reject image, video, music, unrelated wallet, and unrestricted cancellation tools in this package. 6. Add server-side package identity enforcement so `source_package_slug` constrains available tools rather than serving only as attribution. 7. Use a package-specific token whose server-authorized tool set matches the local allowlist. ]]>

other

Warning

• Location: scripts/authorize.py:339
• Finding: Unnecessary Hostname and Agent-Platform Collection and Transmission<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:339-369`, persisted at `scripts/authorize.py:372-387`, transmitted at `scripts/authorize.py:455-468`; platform attribution is also transmitted by `scripts/mcp_client.py:1219-1227` **Vulnerability Type**: Environment reconnaissance and telemetry **Risk Level**: Medium ### Vulnerable Code ```python def detect_host_platform(explicit: str | None = None) -> str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The values are included in the authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: ...[truncated 2181 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not read or transmit the hostname by default. 2. Let the user provide an optional, non-sensitive device label for display in the remote console. 3. Make platform telemetry opt-in and clearly disclose what is collected, why it is needed, its retention period, and how it can be deleted. 4. Use coarse, non-identifying platform categories only when operationally necessary. 5. Avoid adding telemetry fields to every business call; registration should be a separate, consented operation. 6. Rotate or minimize stable installation identifiers and prevent cross-package correlation where it is not required. 7. Remove existing `host.json` data during uninstall and provide a mechanism to delete corresponding server-side telemetry. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:1044
• Finding: Windows Credential Confidentiality Relies on Unverified Inherited ACLs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mcp_client.py:1044-1051`; credential directory and file protection logic at `scripts/authorize.py:120-135` **Vulnerability Type**: Insecure plaintext credential storage permissions **Risk Level**: Medium ### Vulnerable Code ```python def _private_directory(path: Path) -> None: # POSIX gets explicit 700/600. On Windows the state directory lives under # the user profile, whose default ACL is already private to the user — # the same posture as gh/aws/gcloud credential stores. The former custom # DACL ceremony was dropped deliberately: its command patterns read as # hostile to agent safety policies and endpoint security, failing installs # while adding no protection an elevated administrator could not bypass. path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` The client reads the Windows credential file without checking its ACL: ```python def _read_private_credentials(state_dir: Path, path: Path) -> str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` ### Technical Analysis On POSIX systems, the implementation requires the state directory to be owned by the current user with mode `0700` and the credential file to be owned by that user with mode `0600`. On Windows, it assumes inherited profile ACLs are private and neither creates nor verifies a restrictive DACL. The token is stored as ...[truncated 1423 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the token in Windows Credential Manager or protect it with DPAPI rather than retaining a reusable plaintext bearer token in JSON. 2. If file storage remains necessary, create an explicit DACL granting access only to the owning user and required system principals. 3. Validate the directory and file DACL before reading credentials; reject credentials stored with unsafe permissions. 4. Detect redirected profiles and filesystems that do not support the expected Windows security semantics. 5. Keep the existing POSIX ownership, mode, regular-file, and no-follow checks. 6. Reduce the credential's scopes and use package-bound tokens to limit the impact of any local disclosure. 7. Ensure uninstall and revocation remove or invalidate every protected credential copy. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill advertises no explicit permissions, yet its instructions require shell execution, local file access, network communication, environment use, and package modification. This is dangerous because the runtime capabilities materially exceed what a user would infer from the skill declaration, enabling credential access, data exfiltration, or host modification without clear upfront consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented behavior goes far beyond generating voice clips: it includes OAuth/device authorization, local credential storage, arbitrary remote tool invocation, local file uploads, telemetry/registration, uninstall cleanup, and automatic code replacement. This mismatch is dangerous because users may grant or invoke the skill for a narrow media task while unknowingly enabling persistent authentication, data transfer, and executable code changes on the host.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that the bundled client can automatically install newer releases without separate confirmation, which effectively allows code changes after deployment. This is dangerous because any compromise of the update pipeline, publisher account, or distribution controls could silently alter behavior on user systems, and the warning is not prominent relative to the operational instructions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly states that the client silently checks for updates and automatically installs newer releases by default without separate confirmation. Even with integrity checks and rollback protections, modifying local software without clear upfront user consent increases supply-chain and trust risks, and can surprise users in regulated or locked-down environments.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document describes automatic installation registration that transmits package metadata, platform, and a stable external installation reference on first use, while also persisting a local registration cache, but it does not mention any explicit user notice, opt-in, or consent flow. Even if marked non-billable and limited in scope, this is still telemetry-like behavior that can expose identifiable environment information and surprise users, especially in a creative tooling context where such network activity is not obviously necessary.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The client performs silent automatic self-updates during normal command execution, replacing installed package files without an interactive user confirmation at that time. Although the implementation includes substantial integrity checks, this still creates a remote code-modification channel: compromise of the vendor update infrastructure, signing/checksum publication path, or release process would let new code land and execute on the host automatically.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 66% confidence
• Finding: The script stores a bearer access token in plaintext in ~/.beatra/credentials.json. Even though it attempts to restrict file permissions, any local compromise, multi-user misconfiguration, backup leakage, or weak Windows ACL posture could expose a token with very broad scopes including artifacts, speech, voices, and wallet spending, making token theft materially impactful.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 90% confidence
• Finding: This package contains built-in self-modification capability through its update mechanism, allowing it to replace its own installed files. Even with HTTPS, checksum validation, path validation, and rollback logic, self-updating code remains a sensitive trust boundary: any compromise in the release, CDN, or discovery pipeline can convert this into remote code deployment on user systems.

Static analysis

No suspicious patterns detected.