T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Overprivileged Device Token and Unrestricted MCP Tool Dispatch
- Content
View full analysis
- Remediation
View remediation
Security audit
marketplace-main-image-preflight
Security checks for vulnerabilities and agentic risk
Overview
The skill’s image-preflight purpose is real and documented, but it asks for broad shared account authority and silently self-updates executable code by default.
Review this carefully before installing. It can store and reuse a shared Beatra device token, spend credits through Beatra tools, read/list/cancel tasks, upload selected files, register installation metadata, and silently replace its own package files unless automatic updates are disabled with `python3 scripts/mcp_client.py update --auto off`. Install only if you trust Beatra’s account, update, and MCP-tool authorization model for more than this single image workflow.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:937- Finding
Silent Automatic Replacement of Executable Package Code Without Independent Release Signatures
- Content
View full analysis
dict[str, Any]: path = update_home / "state.json" try: value = json.loads(path.read_text(encoding="utf-8")) except (OSError, json.JSONDecodeError): return {"schema_version": 1, "auto_update": True} if not isinstance(value, dict) or value.get("schema_version") != 1: return {"schema_version": 1, "auto_update": True} return value ``` The automatic update path downloads and replaces package files without separate confirmation: ```python if state.get("auto_update", True) is False: re ...[truncated 3632 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (41)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
tasks:read and tasks:cancel are not obviously needed for an image preflight helper and may allow the skill to inspect or interfere with other user operations. In a shared account context, this can expose metadata or disrupt unrelated workloads.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's claimed business purpose does not match referenced uninstall, revocation, and local state deletion behavior. Combining account/session cleanup and package-removal operations with a routine image workflow creates opportunities for destructive actions against local configuration and shared credentials under the guise of normal ecommerce assistance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's claimed business purpose does not match referenced uninstall, revocation, and local state deletion behavior. Combining account/session cleanup and package-removal operations with a routine image workflow creates opportunities for destructive actions against local configuration and shared credentials under the guise of normal ecommerce assistance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's claimed business purpose does not match referenced uninstall, revocation, and local state deletion behavior. Combining account/session cleanup and package-removal operations with a routine image workflow creates opportunities for destructive actions against local configuration and shared credentials under the guise of normal ecommerce assistance.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the bundled `scripts/mcp_client.py` to upload local media and call the
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the bundled `scripts/mcp_client.py` to upload local media and call the
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the bundled `scripts/mcp_client.py` to upload local media and call the
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the bundled `scripts/mcp_client.py` to upload local media and call the
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Silent automatic download and installation of new releases is a strong supply-chain and local integrity risk, especially for a skill whose expected function is just marketplace image preflight/editing. If the update channel, package signing, or distribution path is compromised, arbitrary new behavior could be introduced without a fresh review or user approval.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill requests a very broad OAuth scope set, including artifacts, multiple media-generation domains, task management, and wallet spending, far beyond what an image preflight reviewer would need. Excessive privileges violate least privilege and materially increase blast radius if the skill, its dependencies, or stored token are abused.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
tasks:read and tasks:cancel are not obviously needed for an image preflight helper and may allow the skill to inspect or interfere with other user operations. In a shared account context, this can expose metadata or disrupt unrelated workloads.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file implements substantial behavior unrelated to the advertised marketplace image preflight skill, including package self-update, installation registration, inventory recording, credential handling, and remote tool mediation. In a skill context, this expands the trust boundary far beyond the stated purpose and creates an unnecessary remote code/update channel plus telemetry surface that could be abused if the vendor infrastructure, manifests, or package pipeline are compromised.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The client records a local skill inventory and performs installation registration telemetry to a remote service without being part of the core marketplace image workflow. This creates undisclosed persistence and tracking behavior, exposing what skills are installed, where they are installed, package versions, and platform context, which is particularly risky in an agent ecosystem where users expect narrowly scoped behavior.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
Self-modification/self-update is a real security concern in this skill context because the code can replace local package files from a remote source, which is unrelated to basic marketplace image analysis. This materially increases the blast radius of any supply-chain compromise and makes the skill capable of changing its own behavior after installation.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The uninstall script manages a shared Beatra device credential and can trigger remote authorization revocation, behavior that is unrelated to a marketplace image preflight skill’s stated purpose. Even if framed as uninstall hygiene, this gives the skill package authority over host-level shared authentication state, which is a sensitive cross-skill capability that could disrupt other installed skills or remove access unexpectedly.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script declares and later removes files in ~/.beatra including credentials and shared installation metadata for all skills, not just this package. Because the skill’s declared purpose is marketplace image review, access to and deletion of shared local credential/state files is over-privileged and could break unrelated functionality or destroy security-relevant state.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The presence of credentials.json in the set of files managed by the skill indicates the package is designed to handle shared credentials. For a marketplace image preflight skill, this is unnecessary credential access and expands the blast radius from normal content processing into host authentication compromise or service disruption.
- Content
python #: these and then removes the directory only if it is empty — the script #: never recursively deletes a directory it does not fully understand. _STATE_FILES = ( "credentials.json", "installation.json", "host.json", "skills.json",
Static analysis
No suspicious patterns detected.