T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:30- Finding
Overprivileged Shared Bearer Credential and Unrestricted MCP Tool Invocation
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill is declared as a music-generation package, but its device authorization requests permissions for unrelated image, video, speech, and voice operations. It also requests broad `wallet:spend` authority. These permissions exceed the minimum capabilities required to generate music, upload relevant reference audio, and inspect or cancel associated tasks. The resulting bearer credential is stored in a shared `~/.beatra/credentials.json` file and may be reused by multiple Beatra Skills. This increases the impact of credential theft or misuse because compromise of one package can expose permissions granted for unrelated services. The generic `call` command accepts an arbitrary MCP tool name without applying a local allowlist. Consequently, possession ...[truncated 1552 chars]- Remediation
View remediation