Incident Brief Voice Pack

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:17 AM UTC
• Version: 0.1.2

Overview

The skill’s voice-generation purpose is real, but it also grants broad account authority, uses a generic authenticated tool caller, and silently self-updates executable code.

Review this skill before installing. It is not clearly malicious, but authorizing it gives Beatra a persistent shared device token with broad capabilities, and the bundled client can silently update itself. Install only if you trust Beatra’s account, update, and MCP infrastructure, and consider disabling automatic updates with the documented update --auto off command after installation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Silent Automatic Retrieval and Replacement of Executable Skill Code

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( install_root=resolved_r ...[truncated 2868 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:29

Finding

OAuth Device Token Requests Capabilities Unrelated to Incident Voice Generation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/mcp_client.py:1549

Finding

Generic Authenticated MCP Tool Dispatcher Is Not Restricted to Skill Operations

Content

View full analysis

Remediation

View remediation

` interface. 4. Separate read-only operations, uploads, paid generation, cloning, wallet operations, and cancellation into distinct consent and authorization paths. 5. Require explicit confirmation for paid or destructive operations. 6. Bind task reads and cancellation to task identifiers created by this package and installation. 7. Reject unknown fields rather than forwarding arbitrary arguments. 8. If a generic diagnostic mode must exist, require a separate developer flag and a separately authorized, minimally scoped credential. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:231

Finding

Local File Upload Trusts Any Server-Supplied HTTPS Destination

Content

View full analysis

dict[str, str]: structured = result.get("structuredContent") instruction = structured.get("upload") if isinstance(structured, dict) else None if not isinstance(instruction, dict) or instruction.get("method") != "PUT": raise RuntimeError("Beatra upload instructions are invalid") url = instruction.get("url") headers = instruction.get("headers") if not isinstance(url, str) or not isinstance(headers, dict): raise RuntimeError("Beatra upload instructions are invalid") parsed = urllib.parse.urlsplit(url) if ( parsed.scheme != "https" or not parsed.hostname or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise RuntimeError("Beatra upload instructions are invalid") if not all(isinstance(key, str) and isinstance(value, str) for key, value in headers.items()): raise RuntimeError("Beatra upload instructions are invalid") content_type = _header_value(headers, "Content-Type") content_length = _header_value(headers, "Content-Length") if content_type != mime_type or content_length != str(len(content)): raise RuntimeError("Beatra upload instructions are invalid") response = put_bytes(url, dict(headers), content) artifact_id = response.get("artifact_id") if not isinstance(artifact_id, str) or not artifact_id: raise RuntimeError("Beatra upload returned an invalid response") return {"type": "artifact", "artifact_id": artifact_id} ``` ### Technical Analysis The upload path safely requires a regular file, uses `O_NOFOLLOW` when available, chec ...[truncated 2007 chars]

Remediation

View remediation

other

Warning

• Location: scripts/authorize.py:344

Finding

Authorization Collects and Transmits Host and Stable Installation Identifiers Beyond Core Speech Requirements

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The collected values are included in the authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEVICE_AUTHORIZATION_URL, form) ``` ### Technical Analysis The helper inspects selected envir ...[truncated 2002 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (38)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The voices:write permission allows modification or creation of voice assets, which is not implied by a tool that reads an office-written script and outputs brief voice clips. This gives unnecessary authority over account voice resources and could let the skill alter persistent voice settings or assets beyond transient clip synthesis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The referenced behavior includes uninstall/disconnect flows, revocation calls, local credential deletion, and installed-skill inventory handling, which are unrelated to the declared audio-production function. Hidden lifecycle-management capabilities can alter local state and remove files in ways users do not expect from a voice-pack skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The referenced behavior includes uninstall/disconnect flows, revocation calls, local credential deletion, and installed-skill inventory handling, which are unrelated to the declared audio-production function. Hidden lifecycle-management capabilities can alter local state and remove files in ways users do not expect from a voice-pack skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The referenced behavior includes uninstall/disconnect flows, revocation calls, local credential deletion, and installed-skill inventory handling, which are unrelated to the declared audio-production function. Hidden lifecycle-management capabilities can alter local state and remove files in ways users do not expect from a voice-pack skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatic remote update and self-replacement are not necessary to generate incident brief voice clips and significantly enlarge the attack surface. If the update channel or verification process is compromised, the skill can become a vehicle for persistent arbitrary code changes on the host.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest presents a narrowly scoped text-to-voice incident briefing skill, but the changelog announces unrelated balance and ledger capabilities. That capability mismatch is a strong indicator of hidden financial or account-access functionality that users and reviewers would not reasonably expect from this skill, increasing the risk of deceptive privilege use or covert data access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Access to balances and ledgers is context-inappropriate for generating incident briefing voice clips and suggests overbroad or deceptive capability scope. In this context, such access could expose financial records or enable account reconnaissance through a skill that users would invoke for benign media generation tasks.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The manifest explicitly references a local credential file for device-bearer authentication, which indicates the skill depends on reusable account credentials. In combination with the suspicious finance-related changelog and remote MCP endpoint, this raises the risk that a seemingly simple voice skill could use stored credentials to access unrelated sensitive services or data.

Content

Scanner excerpt · manifest.json (reported line 53)May include surrounding context.

json

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The OAuth scope string grants a very broad set of account capabilities, including artifacts, images, videos, music, speech, voices, task control, and wallet access, while the skill is described only as converting an existing incident script into voice clips. This violates least privilege and means compromise or misuse of this skill would expose far more of the user’s account than necessary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The voices:write permission allows modification or creation of voice assets, which is not implied by a tool that reads an office-written script and outputs brief voice clips. This gives unnecessary authority over account voice resources and could let the skill alter persistent voice settings or assets beyond transient clip synthesis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The voices:write permission allows modification or creation of voice assets, which is not implied by a tool that reads an office-written script and outputs brief voice clips. This gives unnecessary authority over account voice resources and could let the skill alter persistent voice settings or assets beyond transient clip synthesis.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill client contains substantial behavior unrelated to incident voice generation, including self-update, installation registration, host inventory tracking, and telemetry. In a narrowly scoped media-generation skill, bundling package mutation and persistent device tracking increases the attack surface and enables unexpected code changes or data collection beyond user intent.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The package exposes self-update and package replacement functionality, allowing the skill's local code to be modified post-installation. For a skill whose stated purpose is generating incident voice clips, self-modification is a significant risk amplifier because compromise of the update channel or backend trust path could transform a benign tool into a malicious one without a fresh installation event.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This uninstall script is scoped to managing shared Beatra device credentials and revocation, which is materially broader than the skill's declared purpose of generating incident-brief voice clips. Even if framed as cleanup logic, it gives the skill package authority over shared authentication state used by other skills, creating an unnecessary and sensitive control surface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script enumerates and deletes files in the shared ~/.beatra state directory, including inventory and credential-related state for all skills. That exceeds least privilege for a voice-generation skill and creates a path for denial of service or unauthorized tampering with other skills' shared configuration.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The presence of credentials.json in the deletion target list shows the script is designed to handle shared authentication material. Access to credential storage by a skill whose advertised purpose is voice clip generation is unnecessary and increases the blast radius if the package is modified, misused, or invoked unexpectedly.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code performs a network POST to revoke a device bearer token, which is a privileged authentication operation unrelated to audio generation. If abused or triggered unexpectedly, it can disconnect the device from platform services and disrupt other installed skills that rely on the same shared authorization.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The _device_token function reads an access token from credentials.json so the script can perform bearer-token revocation. Reading shared tokens from disk is highly sensitive behavior and is unjustified by the stated functionality of producing incident brief audio, making compromise or misuse more damaging.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):