T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:30- Finding
Overprivileged Device Token and Unrestricted MCP Tool Invocation
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill's declared function is to generate and edit lyric-card images from user-supplied lyrics. Its authorization scope nevertheless includes unrelated capabilities for video generation, music generation, speech generation, voice reading and modification, task cancellation, and wallet spending. This violates least-privilege principles. The excess permissions are directly usable because the bundled client accepts an arbitrary MCP tool name through the `call` subcommand and does not enforce a local allowlist corresponding to the Skill's documented workflow. The shared bearer token is retained in `~/.beatra/credentials.json` and has a sliding 15-day idle lifetim ...[truncated 1495 chars]- Remediation
View remediation