live-commerce-script-studio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:08 AM UTC
• Version: 0.1.3

Overview

This skill appears useful and disclosed, but it requests broad account authority and can silently replace its own package files during normal use.

Review carefully before installing. This skill should only be used if you are comfortable granting Beatra a shared device token with broad media/task/wallet authority, storing it under ~/.beatra, sending limited device/install metadata, and allowing the package to auto-update its own files unless you disable updates with scripts/mcp_client.py update --auto off.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Silent Remote Replacement of Executable Skill Code

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_ ...[truncated 3790 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:30

Finding

Overprivileged Shared Credential and Unrestricted MCP Tool Dispatch

Content

View full analysis

dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The declared workflow requires commerce-script preparation and remote image and speech generation, together with model and voice discovery, task polling, artifact retrieval, and billing information. The requested token additionally includes video generation, music generation, voice writing, task cancellation, generic artifact writing, wallet spending, and generic MCP tool access. The token is also shared across Beatra Skills. This broadens the consequences of credential compromise and ma ...[truncated 1685 chars]

Remediation

View remediation

other

Warning

• Location: scripts/authorize.py:333

Finding

Automatic Collection and Transmission of Host and Agent Metadata

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" ``` It also reads the machine hostname: ```python def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The resulting hostname is added to the remote authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference ...[truncated 2316 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:1042

Finding

Windows Credential Privacy Requirement Is Not Enforced

Content

View full analysis

None: # POSIX gets explicit 700/600. On Windows the state directory lives under # the user profile, whose default ACL is already private to the user — # the same posture as gh/aws/gcloud credential stores. The former custom # DACL ceremony was dropped deliberately: its command patterns read as # hostile to agent safety policies and endpoint security, failing installs # while adding no protection an elevated administrator could not bypass. path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` The credential reader directly reads the file on Windows without validating its ACL: ```python def _read_private_credentials(state_dir: Path, path: Path) -> str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` The documentation states a stronger requirement than the implementation enforces: ```markdown On Windows the current user must be the only principal granted access through the file ACL. ``` ### Technical ...[truncated 1820 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description does not prepare the user for uninstall, credential inspection, token revocation, and deletion of local state under ~/.beatra. Hidden lifecycle-management and credential-adjacent behaviors raise the risk of accidental data loss, unauthorized token handling, or overbroad trust in a skill that appears to only write livestream scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description does not prepare the user for uninstall, credential inspection, token revocation, and deletion of local state under ~/.beatra. Hidden lifecycle-management and credential-adjacent behaviors raise the risk of accidental data loss, unauthorized token handling, or overbroad trust in a skill that appears to only write livestream scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description does not prepare the user for uninstall, credential inspection, token revocation, and deletion of local state under ~/.beatra. Hidden lifecycle-management and credential-adjacent behaviors raise the risk of accidental data loss, unauthorized token handling, or overbroad trust in a skill that appears to only write livestream scripts.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 71)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The OAuth scope string requests far more access than is justified for a live-commerce script-writing skill, including images, videos, music, speech, voice management, artifact/task operations, and especially wallet spending. If the granted token is later used by the skill or any compromised component, it enables unnecessary high-impact actions well beyond script generation, violating least privilege and increasing blast radius.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 73% confidence

Finding

The code persists a bearer access token in plaintext JSON under ~/.beatra/credentials.json. Although file permissions are restricted on POSIX, plaintext token storage still creates a valuable target: any local compromise, insecure backup, or weaker Windows ACL scenario could expose a token carrying broad scopes including wallet spending.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The client contains broad non-core behavior—self-update, installation registration, and local inventory tracking—that is unrelated to a live-commerce script-writing skill. This greatly expands the trust boundary and lets the package modify itself and report local installation metadata, creating supply-chain and privacy risk if the remote service, discovery channel, or package publisher is compromised.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The exposed self-update command confirms the package is designed to modify its own installed code on disk. Self-modification materially increases supply-chain risk and is especially concerning in a skill whose declared purpose is only to generate live-commerce scripts, because the skill gains a mechanism to change future behavior outside normal platform review paths.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file is an uninstall/revocation utility for Beatra device credentials, which is unrelated to the advertised purpose of generating live-commerce scripts. That mismatch is a strong supply-chain red flag because the skill ships operational code that can alter authentication state and local installation records outside user expectations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The function reads an access token from ~/.beatra/credentials.json and uses it for a network revocation request. Accessing shared credentials from within an unrelated skill is dangerous because it grants the package authority over device authentication and creates an opportunity for abuse or accidental disruption if the skill is compromised or modified.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool scope while instructing use of shell, network, file access, and environment-dependent behavior. In an agent environment, missing least-privilege declarations can cause the host to grant broader capabilities than users expect, increasing the blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example invocation uses {"language":"zh-CN"} for beatra.voices.list, which steers the workflow toward a specific language/locale. The file does not clearly state that the skill is limited to Chinese-language output or offer the user a choice of locale, creating a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes silent automatic updates that download and replace package-owned files without separate confirmation, yet this behavior is not clearly disclosed upfront. Even with integrity checks, silent self-modification expands the attack surface and can change behavior after approval, undermining user consent and review assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document states that the client silently checks for updates and installs higher versions automatically without separate confirmation. Even with integrity checks and fixed sources, modifying local executable/package files by default without a clear, explicit opt-in or prominent upfront warning creates a supply-chain and user-consent risk: users may not expect code on their system to change during ordinary commands, and any compromise of the trusted update path would be applied automatically.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 64)May include surrounding context.

md

the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
  detect completion yourself — never ask the user to confirm in chat that
  they approved.

Approval legitimately takes minutes when sign-in or account creation is

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation describes automatic installation registration and creation of a local cache file, but it does not give an explicit user-facing warning that telemetry-like metadata will be sent or that files will be written under the user's home directory. Even if the data is described as non-secret and non-billable, undisclosed background registration can violate user expectations, privacy requirements, or enterprise policy, especially in security-sensitive agent environments.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/session-plan.md (reported line 3)May include surrounding context.

md

# Planning the session

The schedule is the piece everyone in the room works from. It has to be specific enough that a floor manager can call the next move without asking.

## Set the frame first

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file initiates device authorization for broad and sensitive scopes, including wallet spending, but the user-facing prompts only mention opening an approval page and selecting Allow. Without an explicit explanation of what access is being granted, users may consent to powerful capabilities they do not expect from a live-commerce scripting tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.