T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:31- Finding
OAuth Authorization Requests Permissions Beyond the Skill's Functional Requirements
- Content
View full analysis
- Remediation
View remediation
Security audit
lab-cover-set
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent as a Beatra image-generation workflow, but it requests broad account authority and silently self-updates code by default.
Before installing, understand that this skill needs a Beatra account connection that can spend credits, stores a shared bearer token under ~/.beatra, sends device/platform installation metadata to Beatra, and silently updates its package files by default. Review the requested permissions and consider disabling automatic updates if you want each code change to require explicit action.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:969- Finding
Silent Automatic Updates Permit Post-Audit Remote Code Replacement
- Content
View full analysis
bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_ ...[truncated 3143 chars]- Remediation
View remediation
other
Warning
- Location
scripts/authorize.py:343- Finding
Hostname and Agent-Environment Metadata Are Collected and Transmitted Automatically
- Content
View full analysis
str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The hostname is added to the authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name ``` ### Technical Analysis The authorizati ...[truncated 2010 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:1044- Finding
Windows Credential Confidentiality Relies on Unverified Inherited ACLs
- Content
View full analysis
str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` Credential creation similarly restricts permissions only on POSIX: ```python def _private_directory(path: Path) -> None: path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` ### Technical Analysis The documentation states that, on Windows, the current user must be the only principal granted access through the file ACL. The implementation does not create or verify such an ACL. It assumes that the profile directory's inherited ACL is sufficiently private and reads the credential without checking its owner or discretionary access-control entries. That assumption may be false on systems with: - Modified user-profile ACLs - Shared workstations - Enterprise management groups - Files restored from backups with altered permissions - Credential directories created through migration or synchronization - Local groups granted broader read access The credential is a bearer token, so possession is sufficient for reuse. The danger is a ...[truncated 1318 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (43)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Task read/cancel permissions are unrelated to generating static lab cover images and expand the blast radius of the credential into workflow management. A compromised or overreaching skill could inspect or cancel user tasks that have nothing to do with this package.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill documentation references uninstall/disconnect behavior, modifying ~/.beatra state, inspecting installed inventory, revoking authorization, and deleting credential-related files, which are far outside the declared lab-cover workflow. Packaging destructive administrative actions alongside a benign creative skill increases the risk of unexpected data loss, account disruption, or abuse if the skill is invoked in the wrong context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill documentation references uninstall/disconnect behavior, modifying ~/.beatra state, inspecting installed inventory, revoking authorization, and deleting credential-related files, which are far outside the declared lab-cover workflow. Packaging destructive administrative actions alongside a benign creative skill increases the risk of unexpected data loss, account disruption, or abuse if the skill is invoked in the wrong context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill documentation references uninstall/disconnect behavior, modifying ~/.beatra state, inspecting installed inventory, revoking authorization, and deleting credential-related files, which are far outside the declared lab-cover workflow. Packaging destructive administrative actions alongside a benign creative skill increases the risk of unexpected data loss, account disruption, or abuse if the skill is invoked in the wrong context.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Referencing ~/.beatra/credentials.json indicates direct dependence on a local credential store, which is a sensitive resource. In the context of a benign-seeming media-generation skill, this is more dangerous because users would not reasonably expect local account credentials to be involved; any compromise or overbroad tool access could expose or misuse those secrets.
- Content
json }, "mcp": { "authentication": "device-bearer", "credential_file": "~/.beatra/credentials.json", "name": "beatra", "transport": "streamable-http", "url": "https://mcp.beatra.ai/mcp"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document describes automatic remote installation registration for a skill whose stated purpose is local lab cover generation. Even if labeled non-billable and non-secret, it transmits package metadata, platform, and a stable external installation reference to a backend, creating undeclared telemetry and a persistent installation identifier that is unnecessary for the advertised functionality.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The described behavior performs remote registration and captures the real agent environment via environment signatures or host metadata, which amounts to host-environment fingerprinting. In the context of a simple cover-creation skill, this collection is disproportionate and increases privacy, tracking, and enterprise reconnaissance risk because it reveals platform details and a durable installation reference unrelated to generating covers.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The OAuth scope string requests a very broad set of capabilities, including artifact access, image/video/music/speech generation, voice read/write, wallet spending, and task operations, while the skill description only needs still-image lab cover generation. This violates least privilege and means any stolen token or misused skill execution could access or spend through unrelated APIs far beyond the user’s expected consent.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Task read/cancel permissions are unrelated to generating static lab cover images and expand the blast radius of the credential into workflow management. A compromised or overreaching skill could inspect or cancel user tasks that have nothing to do with this package.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file claims to support a lab cover generation skill, but the implementation is a generic authenticated remote client with package self-update, telemetry, upload, and arbitrary tool invocation capabilities. This mismatch materially increases risk because users and reviewers may grant trust based on a narrow creative purpose while the code can perform broader networked actions and local package modification.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code can download manifests and archives from remote services and replace local package files, which is a self-modifying capability unrelated to the stated assignment-cover purpose. Even with integrity checks, this expands the attack surface substantially: compromise of the update channel, signing process, or upstream package source could lead to silent code replacement on the user's system.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The exposed CLI includes a self-update command and the broader file implements code download and replacement routines, giving the skill a direct self-modification path. In a lab-cover generation context, self-modifying behavior is unusually powerful and dangerous because it enables the code's future behavior to change after installation, undermining static review and user expectations.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",