T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Image-Only Skill Requests Excessive Full-Service Authorization Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
Crowdfunding Gallery Stills
Security checks for vulnerabilities and agentic risk
Overview
This image-generation skill is not clearly malicious, but it needs Review because it uses a broad reusable Beatra token and silently self-updates executable package files.
Install only if you are comfortable giving this Beatra package a shared, broad device token and allowing default silent updates of its local scripts. Before use, consider disabling auto-update with the documented update --auto off command and review the Beatra authorization page/scopes carefully; revoke the device in the Beatra Console if you no longer trust the package.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/mcp_client.py:1474- Finding
Bundled MCP Client Allows Arbitrary Tool Invocation with a Privileged Token
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) def main() -> int: parser = argparse.ArgumentParser(description="Call Beatra through Streamable HTTP") subparsers = parser.add_subparsers(dest="command", required=True) subparsers.add_parser("verify", help="Run the non-billable connection check") subparsers.add_parser("tools", help="List available Beatra tools") call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The command-line interface accepts an arbitrary `tool_name` and sends it directly in an authenticated MCP `tools/call` request. There is no local allowlist restricting execution to the image, model, task, wallet-read, upload, and registration operations required by the Skill. This becomes particularly dangerous because the authorization token carries broad media-generation and wallet-spending permissions. Input is constrained to a JSON object, but this only validates its representation; it does not constrain the operation being requested. The result is a ge ...[truncated 1424 chars]- Remediation
View remediation
other
Warning
- Location
scripts/authorize.py:341- Finding
Authorization Collects and Transmits Hostname and Agent-Environment Telemetry
- Content
View full analysis
str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The collected values are added to the authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name ``` ### Technical Analysis The authorization helper inspects process-environment signatures to identify ...[truncated 2027 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:939- Finding
Silent Default Self-Update Allows Post-Review Replacement of Executable Skill Files
- Content
View full analysis
bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( inst ...[truncated 3988 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill references uninstall/disconnect behavior that reads and modifies local state, revokes authorization, and deletes credentials, which is unrelated to producing gallery stills. Bundling lifecycle-management actions into a creative-production skill broadens local-system impact and creates risk of unintended state changes or destructive actions under an unexpected trust model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill references uninstall/disconnect behavior that reads and modifies local state, revokes authorization, and deletes credentials, which is unrelated to producing gallery stills. Bundling lifecycle-management actions into a creative-production skill broadens local-system impact and creates risk of unintended state changes or destructive actions under an unexpected trust model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill references uninstall/disconnect behavior that reads and modifies local state, revokes authorization, and deletes credentials, which is unrelated to producing gallery stills. Bundling lifecycle-management actions into a creative-production skill broadens local-system impact and creates risk of unintended state changes or destructive actions under an unexpected trust model.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The manifest explicitly references a local credential file (
~/.beatra/credentials.json) for device-bearer authentication to a remote MCP endpoint. Even though this is normal integration metadata, exposing or depending on local bearer-token material increases the risk that a skill can cause authenticated actions or access account data if the runtime grants it MCP tool access without strong scoping and consent.- Content
json }, "mcp": { "authentication": "device-bearer", "credential_file": "~/.beatra/credentials.json", "name": "beatra", "transport": "streamable-http", "url": "https://mcp.beatra.ai/mcp"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file describes a bundled client that silently checks for, downloads, and installs software updates, which is unrelated to the skill's stated purpose of generating crowdfunding gallery stills. Even with integrity checks and rollback protections, embedding self-updating system-modifying behavior in a content-generation skill expands the attack surface and creates an unnecessary path for code changes on the user's machine.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Silent automatic download and installation is especially risky because it changes local software without a separate user action, which is unjustified for a gallery-still generation skill. A compromised update channel, implementation flaw, or misconfiguration could lead to unauthorized code deployment while the user expects only media-generation assistance.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The OAuth scope string requests a very broad set of privileges, including artifacts write/read, videos, music, speech, voices read/write, wallet spending, and task cancellation, which are not necessary for a skill described as generating crowdfunding gallery stills. Over-scoped authorization violates least privilege and turns compromise or misuse of this skill into cross-capability account abuse, including possible spending and access to unrelated user assets.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The authorization flow operationalizes the excessive scope request by obtaining and persisting a bearer token with capabilities far beyond the stated gallery-still purpose. Because the code stores and validates this multi-purpose credential as the shared live credential for the skill, any later use of the token can exercise unrelated high-risk functions such as wallet spending or non-image media generation.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
This code persists a bearer access token in a JSON file on disk under the user's home directory. Although POSIX permissions are tightened, storing a high-privilege token with broad scopes in plaintext materially increases the blast radius of local compromise, backup leakage, or accidental disclosure, especially because the token authorizes capabilities unrelated to this skill's purpose.
- Content
python scope = _required_string(polled, "scope") if set(scope.split()) != set(SCOPE.split()): raise RuntimeError("Beatra authorization returned an unsupported scope") credential_path = state_dir / "credentials.json" _atomic_json( credential_path, {
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The client includes a full self-update and installation-management subsystem that is unrelated to the advertised purpose of generating crowdfunding gallery stills. Even though there are integrity checks, this dramatically expands the trust boundary: a creative skill can download and replace its own local package files, creating a software supply-chain and persistence mechanism that is much more dangerous in this context because users would not expect filesystem-modifying installer behavior from an image-generation skill.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The exposed update command enables the package to replace its own installed code, i.e., self-modification. In the context of a gallery-still skill, self-modifying behavior is especially dangerous because it enables persistence and post-install behavior changes outside the narrow expected feature set, and any compromise of the update channel would directly become arbitrary code deployment.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",