personalized-song-maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:15 AM UTC
• Version: 0.1.1

Overview

This song-making skill is mostly disclosed, but it grants and uses broader Beatra account powers than a personalized song workflow needs.

Install only if you are comfortable giving this package a broad Beatra device authorization that can spend credits and access multiple media/task capabilities, not just generate one song. Disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if you want reviewed code to stay fixed, and avoid using the generic upload or arbitrary tool-call paths unless you intentionally chose the file or operation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Silent Automatic Retrieval and Installation of Remotely Controlled Code

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _appl ...[truncated 3047 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:34

Finding

Device Authorization Requests Permissions Beyond the Song-Making Function

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/mcp_client.py:1462

Finding

Generic MCP Dispatch Allows Calls Outside the Declared Skill Boundary

Content

View full analysis

dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` The tool name is accepted directly from the command line: ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` The dispatch branch performs no package-specific validation: ```python elif args.command in {"tools", "call"}: result = _run_command(args.command, getattr(args, "tool_name", None)) print(json.dumps(result, ensure_ascii=False, separators=(",", ":"))) if failure := _tool_failure_message(result): print(failure, file=os.sys.stderr) return 1 ``` ### Technical Analysis The bundled client accepts any MCP tool name provided by the caller and forwards it with the shared bearer credential. There is no allowlist limiting execution to the tools required by the personalized-song workflow. This behavior is especially risky because the associated token includes permissions for unrelated media generation, ...[truncated 1317 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mcp_client.py:191

Finding

Upload Command Can Transmit Any User-Readable Regular File to a Server-Selected HTTPS Destination

Content

View full analysis

tuple[str, bytes]: candidate = path.expanduser() descriptor = -1 try: flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) descriptor = os.open(candidate, flags) before = os.fstat(descriptor) if ( not stat.S_ISREG(before.st_mode) or before.st_size < 1 or before.st_size > MAX_UPLOAD_BYTES ): raise RuntimeError( f"Local upload must be one regular file between 1 and {MAX_UPLOAD_BYTES} bytes" ) with os.fdopen(descriptor, "rb") as handle: descriptor = -1 content = handle.read(MAX_UPLOAD_BYTES + 1) after = os.fstat(handle.fileno()) stable_fields = ("st_dev", "st_ino", "st_size", "st_mtime_ns") if ( len(content) != before.st_size or len(content) > MAX_UPLOAD_BYTES or any(getattr(before, field) != getattr(after, field) for field in stable_fields) ): raise RuntimeError("Local upload changed while it was being read") except RuntimeError: raise except OSError as exc: raise RuntimeError("Local upload must be one readable regular file") from exc finally: if descriptor >= 0: os.close(descriptor) return candidate.name, content ``` The destination validation permits any HTTPS hostname: ```python parsed = urllib.parse.urlsplit(url) if ( parsed.scheme != "https" or not parsed.hostname or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise RuntimeError("Beatra upload i ...[truncated 3010 chars]

Remediation

View remediation

other

Note

• Location: scripts/authorize.py:343

Finding

Hostname and Agent-Environment Metadata Are Collected and Transmitted During Authorization

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The collected values are included in the authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEV ...[truncated 1877 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (41)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill requests voices:read and voices:write in addition to speech/music generation, which exceeds what is normally necessary for producing a personalized song. Voice management permissions could expose or alter voice assets beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The same skill package includes uninstall and credential/state-removal logic that is unrelated to the declared personalized-song workflow. Bundling destructive local state modification and token revocation into a creative skill increases the blast radius if the skill is misused, invoked incorrectly, or socially engineered.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The same skill package includes uninstall and credential/state-removal logic that is unrelated to the declared personalized-song workflow. Bundling destructive local state modification and token revocation into a creative skill increases the blast radius if the skill is misused, invoked incorrectly, or socially engineered.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The same skill package includes uninstall and credential/state-removal logic that is unrelated to the declared personalized-song workflow. Bundling destructive local state modification and token revocation into a creative skill increases the blast radius if the skill is misused, invoked incorrectly, or socially engineered.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

oundary: one song generation from the approved inputs. Invoke only the bundled `scripts/mcp_client.py`: the MCP tool name is the CLI argument and its arguments

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

oundary: one song generation from the approved inputs. Invoke only the bundled `scripts/mcp_client.py`: the MCP tool name is the CLI argument and its arguments

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

oundary: one song generation from the approved inputs. Invoke only the bundled `scripts/mcp_client.py`: the MCP tool name is the CLI argument and its arguments

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

oundary: one song generation from the approved inputs. Invoke only the bundled `scripts/mcp_client.py`: the MCP tool name is the CLI argument and its arguments

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

oundary: one song generation from the approved inputs. Invoke only the bundled `scripts/mcp_client.py`: the MCP tool name is the CLI argument and its arguments

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

oundary: one song generation from the approved inputs. Invoke only the bundled `scripts/mcp_client.py`: the MCP tool name is the CLI argument and its arguments

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 67)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The OAuth scope set is far broader than what a personalized song generator needs. Requesting artifacts, images, videos, voice management, task control, and especially wallet spending violates least privilege and increases blast radius if the token is abused or the skill is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill requests voices:read and voices:write in addition to speech/music generation, which exceeds what is normally necessary for producing a personalized song. Voice management permissions could expose or alter voice assets beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill requests voices:read and voices:write in addition to speech/music generation, which exceeds what is normally necessary for producing a personalized song. Voice management permissions could expose or alter voice assets beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This package exposes self-modification capability through a built-in self-update command, enabling the skill to replace its own files on disk. Even with checksum and manifest validation, self-modifying behavior is high risk for a non-admin creative skill because it creates a supply-chain and trust-management hazard far beyond the song-generation task users requested.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool scope or permissions despite directing use of shell, file, network, and environment-capable operations via the bundled client and related workflows. That omission weakens least-privilege controls and makes it easier for a seemingly simple content-generation skill to exercise broader capabilities than a user would reasonably expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.