AI Product-on-Model Locale Studio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:15 AM UTC
• Version: 0.1.3

Overview

This image-generation skill is mostly disclosed, but it asks for unusually broad account authority and can silently replace its own executable code.

Install only if you are comfortable granting Beatra a shared persistent token with paid-service authority beyond this one image workflow. Review the approval page carefully, consider disabling automatic updates with the documented --auto off command, and avoid using sensitive unreleased product or brand files unless your organization permits uploads to Beatra-controlled services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:31

Finding

Overprivileged Shared Device Token and Unrestricted Tool Dispatch

Content

View full analysis

dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill declares an image-based product-on-model workflow, but its Device Token requests unrelated privileges for video, music, speech, and voice generation and management. These permissions exceed the minimum scope needed for image transformation, artifact upload, model discovery, billing, and task tracking. The client also accepts any caller-supplied MCP tool name and forwards it to the service without enforcing a package-specific allowlist. Consequently, the unrelated grants are operationally reachable and are not merely unused scope metadata. Because the credential is shared across Beatra Skill packages and includes `wallet:spend`, compromise of the credential or misuse of th ...[truncated 1099 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Silent Remote Code Replacement Enabled by Default

Content

View full analysis

dict[str, Any]: path = update_home / "state.json" try: value = json.loads(path.read_text(encoding="utf-8")) except (OSError, json.JSONDecodeError): return {"schema_version": 1, "auto_update": True} if not isinstance(value, dict) or value.get("schema_version") != 1: return {"schema_version": 1, "auto_update": True} return value ``` ```python # scripts/mcp_client.py:969-1017 def maybe_auto_update( *, state_dir: Path | None = None, install_root: Path | None = None, get_bytes: GetBytes = _default_get_bytes, now: float | None = None, ) -> bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at ...[truncated 3090 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:231

Finding

Server-Controlled Upload Grant Allows Arbitrary HTTPS Destinations

Content

View full analysis

dict[str, str]: structured = result.get("structuredContent") instruction = structured.get("upload") if isinstance(structured, dict) else None if not isinstance(instruction, dict) or instruction.get("method") != "PUT": raise RuntimeError("Beatra upload instructions are invalid") url = instruction.get("url") headers = instruction.get("headers") if not isinstance(url, str) or not isinstance(headers, dict): raise RuntimeError("Beatra upload instructions are invalid") parsed = urllib.parse.urlsplit(url) if ( parsed.scheme != "https" or not parsed.hostname or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise RuntimeError("Beatra upload instructions are invalid") if not all(isinstance(key, str) and isinstance(value, str) for key, value in headers.items()): raise RuntimeError("Beatra upload instructions are invalid") content_type = _header_value(headers, "Content-Type") content_length = _header_value(headers, "Content-Length") if content_type != mime_type or content_length != str(len(content)): raise RuntimeError("Beatra upload instructions are invalid") response = put_bytes(url, dict(headers), content) artifact_id = response.get("artifact_id") if not isinstance(artifact_id, str) or not artifact_id: raise RuntimeError("Beatra upload returned an invalid response") return {"type": "artifact", "artifact_id": artifact_id} ``` ### Technical Analysis The upload grant is received from the MCP service and controls the URL and headers used to ...[truncated 1802 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:1044

Finding

Windows Device Token ACL Is Neither Enforced nor Verified

Content

View full analysis

None: if os.name == "posix": path.chmod(0o600) ``` ```python # scripts/mcp_client.py:1044-1051 def _read_private_credentials(state_dir: Path, path: Path) -> str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` ### Technical Analysis On POSIX systems, the implementation sets restrictive modes and verifies directory ownership, file ownership, regular-file status, and exact permissions before reading the token. On Windows, it assumes that the user-profile directory's inherited ACL is private and reads the credential without checking its owner or discretionary access-control list. This differs from the documented requirement in `references/installation-and-auth.md:16-20`, which states that the current user must be the only principal granted access. Windows profile ACLs may be altered by administrators, enterprise policy, migration tools, backup software, or prior user configuration. Files can consequently inherit access for additional local users or groups. The token is persistent and carries broad paid-service privileges, making local disclosure materially significant. ### Attack Path 1. The Skill is authorized on a Windows system where `~/.beatra` inherits a permissive or modified ACL. 2. ...[truncated 683 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also includes uninstall and cleanup behaviors that inspect and modify local state under ~/.beatra, revoke tokens remotely, and remove credential/registration data, none of which are apparent from the stated imaging purpose. Hidden local-state modification and token-management logic can surprise users and make unintended destructive or privacy-impacting actions more likely.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also includes uninstall and cleanup behaviors that inspect and modify local state under ~/.beatra, revoke tokens remotely, and remove credential/registration data, none of which are apparent from the stated imaging purpose. Hidden local-state modification and token-management logic can surprise users and make unintended destructive or privacy-impacting actions more likely.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also includes uninstall and cleanup behaviors that inspect and modify local state under ~/.beatra, revoke tokens remotely, and remove credential/registration data, none of which are apparent from the stated imaging purpose. Hidden local-state modification and token-management logic can surprise users and make unintended destructive or privacy-impacting actions more likely.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 71)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The authorization helper requests a very broad OAuth scope set including wallet spending, task control, and multiple media-generation capabilities that are unrelated to a product-on-model image skill. If the token is issued, compromise or misuse of this skill grants far more authority than necessary, violating least privilege and increasing account and billing risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The client contains extensive self-update, package replacement, rollback, and installation-state management logic that is unrelated to the declared product-image generation purpose. Even though there are integrity checks, this materially increases attack surface and enables the skill to modify its own local codebase, which is risky in an agent-skill context because a compromised update channel or publisher account could push arbitrary new behavior onto user systems.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill explicitly supports self-update and package replacement, which is a form of self-modification. In an agent-skill context this is dangerous because the installed code can change independently of the host's normal review and deployment controls, and the skill's declared purpose does not require this capability.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The script reads an access token from ~/.beatra/credentials.json and uses it to call a remote revocation endpoint, giving the skill direct access to shared authentication material. In the context of a fashion-image skill, direct credential handling is unnecessary and dangerous because any compromise, modification, or repurposing of this code could abuse the token to disrupt service or extend into broader credential misuse.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool/permission scope even though its documented behavior requires shell, network, file read/write, and likely environment access. That increases the blast radius if the skill is misused, modified, or invoked in an unexpected context because consumers cannot constrain it to the minimum required capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill enables silent automatic updates that download and replace package files without separate confirmation. Even with signature/integrity claims, background self-update materially increases supply-chain risk and can change executable behavior after review, especially in a skill that already has shell, network, and file-modification capabilities.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json

"icon": "https://beatra.ai/textures/icons/product-on-model-locale-studio-0.1.1.png",
  "localized": {
    "en": {
      "description": "Create AI product-on-model images and clothing try-on presentations from apparel and wearable-accessory product photos for localized ecommerce campaigns. Plan one fashion-model visual per market with market-specific casting, styling, pose, and shopping scene, then prepare product-on-model photography for fashion listings, apparel ads, Shopify storefronts, Amazon Fashion pages, and social commerce launches.",
      "display_name": "AI Product-on-Model Locale Studio",
      "summary": "Turn apparel and wearable product photos into localized on-model ecommerce images, with one fashion-model visual for each market.",
      "tags": [

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest defines localized content for specific languages and the changelog explicitly instructs handling Simplified Chinese terms in a prescribed way. This reflects a language/locale constraint in the skill metadata without any accompanying indication that users can choose or opt into locale behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 64)May include surrounding context.

md

the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
  detect completion yourself — never ask the user to confirm in chat that
  they approved.

Approval legitimately takes minutes when sign-in or account creation is

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file documents an automatic external installation-registration call that is unrelated to the skill’s advertised image-generation purpose. Hidden or non-essential network telemetry expands the skill’s behavior beyond user expectations, creating privacy, governance, and supply-chain trust risks even if the transmitted fields are described as non-secret.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This describes telemetry-style installation reporting on first use without a clear functional need tied to apparel visualization or localized creative generation. Even limited metadata such as package slug, version, platform, and stable installation reference can enable deployment tracking and environment profiling, which is risky when not clearly justified or consented to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document states that a network registration call occurs on first use, but the skill’s stated purpose does not clearly warn users that installation metadata will be transmitted externally. This lack of transparent disclosure undermines informed consent and can violate organizational expectations or policy controls around outbound communications from creative tooling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger text activates on very broad user intents like 'remove, uninstall, or delete this package' or 'disconnect this device,' which can overlap with ordinary user requests unrelated to this specific skill. In an agent environment, such over-broad matching can cause the uninstall workflow to run unexpectedly, leading to package removal or connection changes when the user intended a different deletion action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.