T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:31- Finding
Over-Privileged Device Authorization and Unrestricted MCP Tool Dispatch
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill is declared as a character-image generation utility. Its legitimate requirements include image generation and transformation, reference-image upload, model discovery, and task management. The authorization request nevertheless obtains permissions for unrelated capabilities, including: - Video generation - Music generation - Speech generation - Voice creation and modification - General wallet spending - Broad artifact access - Task cancellation across the shared authorization context The local MCP client compounds this excessive scope by accepting an arbitrary `tool_name` from the command line and forwarding it through `tools/call`. It does not enforce a package-specific allowlist before attaching the full-scope bearer token. The bearer token is ...[truncated 1641 chars]- Remediation
View remediation