product-photo-studio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:08 AM UTC
• Version: 0.1.9

Overview

This product-photo skill is generally coherent, but it requests broad account powers and silently updates executable code, so it should be reviewed before installation.

Install only if you are comfortable granting Beatra broad account capabilities, storing a reusable local bearer token, sending limited device/platform metadata, and allowing default automatic package updates. Consider disabling auto-updates with the documented command and reviewing the Beatra authorization scopes before approving.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:32

Finding

Authorization Requests Permissions Beyond Product-Photography Requirements

Content

View full analysis

Vulnerability Details

File Location: scripts/authorize.py:32-35
Vulnerability Type: Excessive OAuth authorization scope
Risk Level: High

Affected code:

python

SCOPE = (
    "mcp:tools artifacts:write images:generate videos:generate music:generate "
    "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel"
)

Technical Analysis

The Skill's declared purpose is to upload product photographs and generate or edit product images. However, its device authorization requests permissions for unrelated capabilities, including:

• Video generation
• Music generation
• Speech generation
• Voice reading and writing
• Generic MCP tool access
• Wallet spending
• Task cancellation

Image generation, necessary artifact operations, and limited task access are consistent with the declared functionality. Video, music, speech, and voice permissions are not required for product-photo processing. The generic mcp:tools and financially sensitive wallet:spend scopes also expand the consequences of credential misuse.

This violates least privilege because the bearer credential stored by the Skill can potentially authorize substantially more activity than the advertised task requires.

Attack Path

1. The user runs scripts/authorize.py.
2. The authorization request asks the user to approve the complete scope string.
3. Beatra returns a bearer token containing the approved broad privileges.
4. The token is stored in ~/.beatra/credentials.json.
5. A compromised Skill update, malicious local process running as the same user, or other credential compromise obtains or uses that token.
6. The token is used for unrelated voice, speech, music, or video operations, or to spend wallet credits beyond the Skill's legitimate image-processing needs.

No direct token theft was found in the reviewed version. The vulnerability is the unnecessarily broad authority a ...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

• Remove videos:generate, music:generate, speech:generate, voices:read, and voices:write.
• Limit authorization to image generation/editing, required artifact upload/read operations, and the minimum task lookup permissions.
• Replace generic mcp:tools with operation-specific scopes if the service supports them.
• Replace unrestricted wallet:spend with a narrowly constrained image-generation billing scope, spending cap, or per-operation authorization.
• Request task-cancellation permission only when the user explicitly chooses to enable cancellation.
• Use incremental authorization if unrelated media capabilities are added later, with separate and explicit user consent.
• Document each requested scope and why it is necessary on the approval screen.

other

Warning

• Location: scripts/authorize.py:340

Finding

Hostname and Agent-Environment Metadata Are Collected and Transmitted

Content

View full analysis

Vulnerability Details

File Location: scripts/authorize.py:340-369, scripts/authorize.py:442-457, scripts/mcp_client.py:1140-1163, scripts/mcp_client.py:1215-1227, scripts/mcp_client.py:1380-1414
Vulnerability Type: Environment metadata collection and telemetry
Risk Level: Medium

Affected code:

python

def detect_host_platform(explicit: str | None = None) -> str:
    """The agent environment this process runs inside (docs/device-model.md).

    Order: explicit agent self-report > environment signatures > unknown.
    Detection reads the process environment only — nothing else runs,
    nothing reaches the network.
    """
    if explicit:
        candidate = explicit.strip().lower().replace(" ", "-")
        if _PLATFORM_VALUE.fullmatch(candidate):
            return candidate
    env = os.environ
    if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env:
        return "claude-code"
    if any(key.startswith("CODEX_") for key in env):
        return "codex"
    ai_agent = env.get("AI_AGENT", "").lower()
    matched = re.match(r"([a-z0-9-]+)_", ai_agent)
    if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)):
        return matched.group(1)
    return "unknown"


def device_display_name() -> str | None:
    """A hostname the user will recognise in the console device list."""
    try:
        name = socket.gethostname().strip()
    except OSError:
        return None
    if not name or not name.isprintable():
        return None
    return name[:120]

The collected hostname is included in the remote authorization request:

python

form: dict[str, str] = {
    "client_id": CLIENT_ID,
    "resource": MCP_URL,
    "scope": SCOPE,
    "platform": host_platform,
    "client_name": PACKAGE_DISPLAY_NAME,
    "external_installation_ref": external_reference,
    "package_version": PACKAGE_VERSION,
    "package_slug": PACKAGE
...[truncated 3015 chars]

Remediation

View remediation

Remediation Suggestions

• Do not collect or transmit the real hostname by default.
• Generate a random, non-identifying local device label, or allow the user to choose a display name.
• Make installation telemetry opt-in and disclose every field before transmission.
• Remove source_platform from ordinary business calls unless it is essential to request processing.
• Provide a persistent telemetry-disable setting that covers registration and per-call attribution.
• Minimize retention and correlation of the installation reference on the service side.
• If platform detection is required for compatibility, keep it local and transmit only a coarse capability identifier.
• Apply restrictive permissions to host.json, consistent with other files in ~/.beatra.

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Default Silent Updater Downloads and Replaces Executable Skill Code

Content

View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:31-32, scripts/mcp_client.py:969-1019, scripts/mcp_client.py:1543; documented in SKILL.md:149-166 and references/automatic-updates-and-safety.md:3-19
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Affected code:

python

PACKAGE_DISCOVERY_URL = "https://beatra.ai/skills/product-photo-studio/channels/clawhub/install.json"
PACKAGE_CDN_BASE_TEMPLATE = "https://cdn.beatra.ai/agent-packages/product-photo-studio/channels/clawhub/v{version}"

python

def maybe_auto_update(
    *,
    state_dir: Path | None = None,
    install_root: Path | None = None,
    get_bytes: GetBytes = _default_get_bytes,
    now: float | None = None,
) -> bool:
    """Best-effort silent update. Never block the requested MCP command."""

    resolved_state = state_dir or Path.home() / ".beatra"
    try:
        resolved_root = (install_root or _current_install_root()).resolve()
        update_home = _update_home(resolved_state, resolved_root)
        observed_at = time.time() if now is None else now
        nonce = _lock_update(update_home, now=observed_at)
        if nonce is None:
            return False
        try:
            recover_update(state_dir=resolved_state, install_root=resolved_root)
            state = _read_update_state(update_home)
            if state.get("auto_update", True) is False:
                return False
            last_checked = state.get("last_checked_at")
            if (
                isinstance(last_checked, (int, float))
                and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS
            ):
                return False
            state["last_checked_at"] = observed_at
            _write_private_json(update_home / "state.json", state)
            checked = check_update(get_bytes=get_bytes)
            if not checked["update_av
...[truncated 3429 chars]

Remediation

View remediation

Remediation Suggestions

• Disable automatic installation by default; automatic update checks may remain enabled, but code replacement should require explicit user approval.
• Display the current version, proposed version, source, and changed-file list before installation.
• Support version pinning and a policy that prevents unattended updates in controlled environments.
• Sign release metadata and archives with an offline-verifiable publisher key pinned in the installed client.
• Separate release-signing authority from the web discovery and CDN infrastructure.
• Use threshold signing or hardware-backed release keys for high-value release channels.
• Define secure key rotation and revocation procedures.
• Preserve the existing fixed-host, redirect-rejection, path-validation, size-limit, transaction, and rollback controls.
• Record an auditable update log without including credentials or user content.
• Re-run security review when an update changes executable scripts, requested scopes, endpoints, or credential behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a photo-transformation tool, yet documentation indicates uninstall/cleanup operations, token revocation, installation-state management, and local credential/config access. This is a significant scope expansion unrelated to the core user task, creating opportunities for unexpected account-side effects and local-state modification under the guise of simple image editing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a photo-transformation tool, yet documentation indicates uninstall/cleanup operations, token revocation, installation-state management, and local credential/config access. This is a significant scope expansion unrelated to the core user task, creating opportunities for unexpected account-side effects and local-state modification under the guise of simple image editing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a photo-transformation tool, yet documentation indicates uninstall/cleanup operations, token revocation, installation-state management, and local credential/config access. This is a significant scope expansion unrelated to the core user task, creating opportunities for unexpected account-side effects and local-state modification under the guise of simple image editing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatic package download and installation is not necessary for the narrow purpose of transforming product photos and introduces a software supply-chain risk. If the update channel, signing process, identity binding, or CDN/discovery path is ever compromised, the skill has a built-in mechanism to fetch and install attacker-controlled code on the host.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 72)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The OAuth scope requests many powerful capabilities unrelated to the stated function of a product-photo skill, including wallet spending, task control, and generation domains beyond images. This violates least-privilege and means compromise or misuse of the stored token could grant broad account access well outside the user’s expected consent for photo editing.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 74% confidence

Finding

The code stores a bearer access token in a local JSON file on disk for later reuse. Although the implementation attempts to set restrictive permissions, a stolen local token would enable whatever broad scopes were granted, and because the scope set is expansive, token compromise could lead to significant account abuse.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The package explicitly exposes self-update functionality that can download and overwrite local code. In a skill whose advertised purpose is product-photo generation, self-modification is out of scope and increases the blast radius of any backend compromise, manifest abuse, or operational mistake.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill exposes broad operational capabilities—network, shell, file read/write, and environment access—without any explicit tool-scope declaration or least-privilege boundary. In a skill that processes user images and invokes remote services, this increases the blast radius if the implementation is compromised, misused, or later modified to perform unintended actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation states the skill can silently check for updates and automatically replace package-owned files during ordinary command execution. Even with integrity checks, self-modifying behavior inside an agent skill materially changes the trust model: a benign photo-editing skill becomes code that can alter itself on the host without per-update user review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The text states that 'Canonical English installs stay on canonical/en, and SkillHub Chinese installs stay on skillhub/zh-CN,' which enforces specific locale tracks based on install type rather than offering a user choice. This is a natural-language locale policy constraint and no opt-in or alternative selection is described in this file.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json

"icon": "https://beatra.ai/textures/icons/product-photo-studio-0.1.0.png",
  "localized": {
    "en": {
      "description": "Transform a real product photo into a studio-quality ecommerce image, lifestyle scene, or marketplace-ready hero shot. This AI product photography tool replaces backgrounds, improves lighting, and stages scenes while using the source photo and confirmed product details as the visual anchor. Create clean white-background listings, contextual lifestyle compositions, and premium ad visuals from a single phone snap for Amazon, Taobao, Shopify, and social media. Start from one product photo, combine several references, or refine a selected draft toward a polished listing image.",
      "display_name": "AI Product Photo Studio",
      "summary": "Transform a real product photo into a studio-quality ecommerce image, lifestyle scene, or marketplace-ready hero shot with clean backgrounds, professional lighting, and composition guided by confirmed product details.",
      "tags": [

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document states that the client silently checks for updates and automatically installs newer versions without separate confirmation before ordinary commands. Even though it describes integrity checks and fixed update sources, silently replacing installed package files changes local code execution behavior and expands supply-chain risk if the update channel, signing/checking process, or publisher account is ever compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 64)May include surrounding context.

md

the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
  detect completion yourself — never ask the user to confirm in chat that
  they approved.

Approval legitimately takes minutes when sign-in or account creation is

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The client contains broad self-update and installation-telemetry functionality that is unrelated to the advertised photo-editing purpose. Even though there are integrity checks, this code grants the package the ability to download and replace local installation files and contact remote infrastructure without an explicit user action for the core skill, increasing supply-chain and unauthorized-behavior risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The maybe_auto_update() path performs silent update checks and may replace package files during ordinary command execution, without a user-facing prompt at that moment. Silent self-modification in a skill client materially increases supply-chain risk because ordinary use can trigger code replacement from the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document describes automatic installation registration to a remote service and writes to a local cache file, but it does not clearly warn users that metadata will be transmitted externally and that files under ~/.beatra will be created or modified. While the transmitted fields are described as non-secret, silent telemetry and filesystem writes can still create privacy, compliance, and user-consent issues, especially in enterprise or restricted environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.