REDnote Local Business Note Maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:15 AM UTC
• Version: 0.1.1

Overview

This REDnote content skill is mostly disclosed, but it uses broad shared Beatra account authority and silently self-updates executable files, so it needs careful review before installation.

Install only if you trust Beatra with a shared device authorization that can spend credits and access more media capabilities than this one REDnote skill needs. Consider disabling silent updates with `python3 scripts/mcp_client.py update --auto off`, review the Beatra approval scopes, avoid uploading sensitive local files, and revoke the device from the Beatra Console when you no longer need it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:34

Finding

Overbroad Authorization Scopes and Unrestricted MCP Tool Invocation

Content

View full analysis

dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared Skill functionality is limited to creating local-business image posts, including image generation, transformation, editing, source uploads, model discovery, and task monitoring. However, the device authorization requests permissions for unrelated capabilities: - Video generation - Music generation - Speech generation - Voice reading and writing - General wallet spending - Task cancellation The requested `wallet:spend` scope increases the significance of the issue because the resulting bearer credential can authorize billable operations. The same credential is shared across Beatra Skills and has a sliding idle lifet ...[truncated 1800 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:1051

Finding

Silent Remote Package Retrieval and Executable Code Replacement

Content

View full analysis

tuple[str, str]: version = discovery.get("version") archive = discovery.get("archive") manifest = discovery.get("manifest") base_url = discovery.get("base_url") expected_base = PACKAGE_CDN_BASE_TEMPLATE.format(version=version) expected_archive = f"{PACKAGE_SLUG}-skill-{version}.zip" if ( discovery.get("schema_version") != 1 or discovery.get("package") != PACKAGE_SLUG or discovery.get("channel") != PACKAGE_CHANNEL or discovery.get("locale") != PACKAGE_LOCALE or not isinstance(version, str) or archive != expected_archive or manifest != "skill-manifest.json" or base_url != expected_base or not isinstance(discovery.get("archive_sha256"), str) or _SHA256.fullmatch(discovery["archive_sha256"]) is None or not isinstance(discovery.get("manifest_sha256"), str) or _SHA256.fullmatch(discovery["manifest_sha256"]) is None ): raise RuntimeError("Beatra update discovery is invalid") parsed = urllib.parse.urlsplit(expected_base) if ( parsed.scheme != "https" or parsed.hostname != "cdn.beatra.ai" or parsed.username is not None or parsed.password is not None or parsed.query or parsed.fragment ): raise RuntimeError("Beatra update discovery is invalid") return f"{expected_base}/{archive}", f"{expected_base}/{manifest}" def check_update( *, get_bytes: GetBytes = _default_get_by ...[truncated 6426 chars]

Remediation

View remediation

other

Warning

• Location: scripts/authorize.py:340

Finding

Unnecessary Hostname and Agent-Environment Telemetry Collection

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] def write_host_config(state_dir: Path, *, platform: str, device_name: str | None) -> None: """Persist detection results so mcp_client never re-detects per request and still has a truth source when its own env detection comes up empty. Best-effort: config failure must never block authorization.""" try: payload: dic ...[truncated 3578 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes uninstall logic that reads and modifies local state under ~/.beatra, accesses shared credentials and inventory files, performs network revocation, and coordinates package removal, despite being presented as a marketing-note generator. This mismatch is risky because destructive local operations and shared credential/state handling are far more sensitive than the advertised task and could lead to accidental data loss or unwanted state changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes uninstall logic that reads and modifies local state under ~/.beatra, accesses shared credentials and inventory files, performs network revocation, and coordinates package removal, despite being presented as a marketing-note generator. This mismatch is risky because destructive local operations and shared credential/state handling are far more sensitive than the advertised task and could lead to accidental data loss or unwanted state changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes uninstall logic that reads and modifies local state under ~/.beatra, accesses shared credentials and inventory files, performs network revocation, and coordinates package removal, despite being presented as a marketing-note generator. This mismatch is risky because destructive local operations and shared credential/state handling are far more sensitive than the advertised task and could lead to accidental data loss or unwanted state changes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 62)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The script stores a bearer access token to disk in ~/.beatra/credentials.json for reuse, creating a persistent local secret that unlocks broad account capabilities. Even with restrictive POSIX permissions, persistent shared credentials increase blast radius across skills and can be abused by local compromise, token leakage, or unintended cross-skill reuse.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill contains a full self-update mechanism that downloads manifests and archives, then replaces local installation files on disk. Even with checksum and path-validation controls, this behavior exceeds the advertised image/post-generation role and creates a powerful code-modification channel that could turn any upstream compromise, signing/distribution failure, or server-side abuse into local persistent code execution.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The exposed update command enables the skill to self-modify by checking for, downloading, and applying code updates to its own installation. For a skill whose declared purpose is content generation, self-modification materially increases risk because it introduces a persistent code change path unrelated to the user’s immediate task and amplifies supply-chain compromise impact.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script posts a bearer token to a global revocation endpoint and is designed to affect a shared connection used by every installed Beatra skill. A local-business note maker does not inherently need authority to revoke device credentials for other skills; this is a platform-management capability rather than a content-generation one.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes or relies on significant capabilities including shell, filesystem, environment, and network access, but does not declare any explicit tool scope or permission boundary. That makes the effective trust surface much larger than the user-facing content-creation purpose suggests and increases the chance of unintended or unsafe operations being performed without clear consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill can automatically download and replace packaged files at runtime, which is unrelated to its core business-post generation role. Even with stated integrity checks, self-updating code changes the trusted execution base during normal use and creates supply-chain and review-bypass risk if the update channel, metadata, or verification process is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatic updates are enabled silently and may change executable code during skill use without a contemporaneous warning or approval step. This undermines user trust and change control, and it increases the risk that newly introduced behavior, bugs, or compromised update content will execute under previously granted permissions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 2)May include surrounding context.

json

{
  "changelog": "Create a coordinated REDnote local-business discovery note with a store-front cover, store or service highlight, visit-ready closing visual, and local-post direction.",
  "display_name": "REDnote Local Business Note Maker",
  "entry": "SKILL.md",
  "homepage": "https://beatra.ai/skills/rednote-local-business-note-maker",

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This manifest describes activation around generic inputs like a 'merchant brief' or 'brand references' and broad creation behavior without clearly constraining when the skill should be selected instead of other image or social-post skills. Because manifest text is often used for routing, the lack of explicit trigger scope or exclusion examples can cause unintended invocation for ordinary content-creation requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document states that the client silently checks for updates and automatically installs newer releases without separate confirmation. Even with checksum validation, fixed endpoints, redirect refusal, and rollback protections, unattended self-modification of installed files creates security and user-consent risk because code changes can occur during ordinary use without an explicit upfront warning or opt-in at the time of installation or first run.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 64)May include surrounding context.

md

the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
  detect completion yourself — never ask the user to confirm in chat that
  they approved.

Approval legitimately takes minutes when sign-in or account creation is

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes automatic outbound installation registration and collection of package slug, version, platform, and a stable external installation reference, which is unrelated to the skill’s stated purpose of generating local-business social content. Even if labeled non-billable and non-secret, this is still telemetry-like behavior that introduces unnecessary data collection and network activity, creating privacy and trust risks if users are not explicitly informed and given control.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file specifies automatic environment and installation registration, including real agent environment resolution and persistence across runs, without a clear functional need tied to image/content generation. Collecting environment metadata for a creative skill increases fingerprinting and privacy exposure, and the fact that registration happens on first use makes the behavior more sensitive because users may not expect external communication.

Content

No source excerpt is available for this finding.