Resident Event Pack

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:13 AM UTC
• Version: 0.1.2

Overview

The skill mostly matches its event-image purpose, but it asks for broad Beatra account powers and can silently replace its own package code.

Install only if you are comfortable granting this package a shared Beatra Device Token with more than still-image permissions, including non-image media generation and wallet-spend authority. Disable automatic updates before normal use if you need reviewed code to stay fixed, and treat uninstall/disconnect as account-affecting because it can revoke the shared Beatra device credential when no other Beatra skills remain.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:33

Finding

Overprivileged Device Token and Unrestricted MCP Tool Invocation

Content

View full analysis

Vulnerability Details

File Location: scripts/authorize.py:33-37; related invocation logic at scripts/mcp_client.py:1450-1466
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Complete Code Snippets

python

SCOPE = (
    "mcp:tools artifacts:write images:generate videos:generate music:generate "
    "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel"
)

The bundled client also accepts an arbitrary MCP tool name rather than enforcing a Skill-specific allowlist:

python

def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]:
    session = _session_with_registration(
        state_dir=Path.home() / ".beatra",
        post_json=_default_post_json,
    )
    if command == "tools":
        return session.request(2, "tools/list", {})
    try:
        arguments = json.load(os.sys.stdin)
    except json.JSONDecodeError as exc:
        raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc
    if not isinstance(arguments, dict):
        raise RuntimeError("Tool arguments on stdin must be one JSON object")
    assert tool_name is not None
    return session.request(
        2,
        "tools/call",
        {"name": tool_name, "arguments": arguments},
    )

Technical Analysis

The Skill's declared purpose is to create resident-event still images. Its legitimate operations include image generation and editing, optional artifact upload, model discovery, task inspection or cancellation, and billing inspection.

The authorization scope nevertheless includes unrelated capabilities for video generation, music generation, speech generation, and voice creation or modification. It also grants the general wallet:spend permission. These permissions materially exceed what is required for the declared image-pack workflow.

This overbroad authorization is compounded by the generic call interface, which passes any su ...[truncated 2164 chars]

Remediation

View remediation

Remediation Suggestions

1. Request only the scopes required by this Skill, such as image generation or editing, required artifact operations, model discovery, narrowly scoped task access, and necessary billing operations.
2. Remove video, music, speech, and voice-write scopes unless a documented resident-event workflow genuinely requires them.
3. Replace generic wallet spending authority with a narrower image-specific billing permission if the service supports one.
4. Add a local allowlist in mcp_client.py for the precise tools used by this package. Reject every unrecognized tool before establishing or sending an MCP request.
5. Use a separate package-specific credential rather than a shared full-scope Device Token where backend architecture permits.
6. Add server-side package-to-tool authorization so source_package_slug is enforced rather than treated only as telemetry.
7. Clearly show the requested capabilities on the authorization page and require renewed approval whenever privileges expand.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/mcp_client.py:969

Finding

Silent Automatic Retrieval and Replacement of Executable Package Code

Content

View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:969-1017; invocation at scripts/mcp_client.py:1543
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Medium

Complete Code Snippets

python

def maybe_auto_update(
    *,
    state_dir: Path | None = None,
    install_root: Path | None = None,
    get_bytes: GetBytes = _default_get_bytes,
    now: float | None = None,
) -> bool:
    """Best-effort silent update. Never block the requested MCP command."""

    resolved_state = state_dir or Path.home() / ".beatra"
    try:
        resolved_root = (install_root or _current_install_root()).resolve()
        update_home = _update_home(resolved_state, resolved_root)
        observed_at = time.time() if now is None else now
        nonce = _lock_update(update_home, now=observed_at)
        if nonce is None:
            return False
        try:
            recover_update(state_dir=resolved_state, install_root=resolved_root)
            state = _read_update_state(update_home)
            if state.get("auto_update", True) is False:
                return False
            last_checked = state.get("last_checked_at")
            if (
                isinstance(last_checked, (int, float))
                and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS
            ):
                return False
            state["last_checked_at"] = observed_at
            _write_private_json(update_home / "state.json", state)
            checked = check_update(get_bytes=get_bytes)
            if not checked["update_available"]:
                return False
            _ensure_owned_baseline(
                install_root=resolved_root,
                update_home=update_home,
                get_bytes=get_bytes,
            )
            discovery = checked["discovery"]
            manifest, new_files = download_update(discovery, get_bytes=get_bytes)
            _apply_update(
                install_root=resolv
...[truncated 3849 chars]

Remediation

View remediation

Remediation Suggestions

1. Default auto_update to disabled and require explicit, informed user consent before installing a new release.
2. Separate update checking from installation. A normal business command may report that an update exists, but it should not replace code automatically.
3. Sign release metadata and package manifests with an offline publisher key, and pin the corresponding public key in the audited client.
4. Verify signatures independently of TLS and hashes supplied by the same remote discovery document.
5. Consider transparency-log inclusion, threshold signing, or reproducible release attestations for higher assurance.
6. Display the current version, target version, changed files, and signer identity before installation.
7. Preserve the existing fixed-host, redirect-rejection, path-safety, size-limit, ownership, backup, and rollback controls.
8. Provide enterprise policy controls that can permanently disable network-based self-modification.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The authorization flow requests videos, music, speech, and voice read/write permissions even though the skill is presented as generating still event-set layouts. These excess privileges enable misuse of unrelated generation and account capabilities, expanding both abuse potential and privacy exposure if the credential is stolen or the skill acts unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Documentation references uninstall/disconnect behavior that reads and deletes local state, inspects installed-skill inventory, and revokes authorization, despite the skill being presented as an event-graphics generator. Combining content generation with package removal and credential-revocation workflows is risky because it expands the authority of the skill into destructive local state changes unrelated to the user’s core task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Documentation references uninstall/disconnect behavior that reads and deletes local state, inspects installed-skill inventory, and revokes authorization, despite the skill being presented as an event-graphics generator. Combining content generation with package removal and credential-revocation workflows is risky because it expands the authority of the skill into destructive local state changes unrelated to the user’s core task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Documentation references uninstall/disconnect behavior that reads and deletes local state, inspects installed-skill inventory, and revokes authorization, despite the skill being presented as an event-graphics generator. Combining content generation with package removal and credential-revocation workflows is risky because it expands the authority of the skill into destructive local state changes unrelated to the user’s core task.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The manifest declares use of a bearer-authenticated MCP endpoint and points to a local credential file at ~/.beatra/credentials.json. Even though the changelog says the added calls are read-only, exposing or normalizing access to local credential material increases the risk of token misuse, unintended account access, and expansion of privilege if the skill or its dependencies can reach MCP actions beyond the apparent image-generation purpose.

Content

Scanner excerpt · manifest.json (reported line 53)May include surrounding context.

json

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script requests a very broad OAuth scope set, including wallet spending, task control, artifact access, and media-generation capabilities that are unrelated to a resident event still-pack skill. If the skill or its backend is compromised, the granted token could be abused far beyond the user’s expected intent, violating least privilege and materially increasing blast radius.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The authorization flow requests videos, music, speech, and voice read/write permissions even though the skill is presented as generating still event-set layouts. These excess privileges enable misuse of unrelated generation and account capabilities, expanding both abuse potential and privacy exposure if the credential is stolen or the skill acts unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file implements a broad network-capable MCP client with credential handling, generic tool invocation, uploads, telemetry, and update management, which materially exceeds the declared purpose of generating resident event still sets. This creates a large, unnecessary attack surface and gives the skill capabilities that could be repurposed for remote actions unrelated to the user-facing function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The package contains autonomous self-update logic that retrieves manifests and archives from remote infrastructure and overwrites the local installation. Even with checksum validation, this introduces a self-modifying code path unrelated to the skill's stated creative purpose, increasing supply-chain risk and enabling remote behavioral changes after installation.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The presence of a self-update command confirms that the package can modify its own installed code, a powerful capability that is unnecessary for the advertised resident-event generation task. Self-modification materially increases supply-chain and persistence risk because future behavior can change independently of the reviewed package contents.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The code explicitly targets credentials.json as part of removable shared state, indicating the skill is designed to access and delete sensitive authentication material. For a resident event pack skill, handling shared credentials is unrelated to core functionality and raises the risk of credential loss, service disruption, or abuse if repurposed.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code performs OAuth device-token revocation against the Beatra API and is part of uninstall behavior for a skill whose declared purpose is resident event pack generation. Even if framed as cleanup, authorization management and shared-state destruction are privileged actions outside the expected scope of this skill, creating a dangerous capability mismatch and increasing the risk of unexpected account/device impact if the script is invoked.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script reads access tokens from credentials.json and uses them to manage device authorization, which is a sensitive capability not justified by the skill’s advertised function. In the context of a content-generation/event-pack skill, this broadens the trust boundary unnecessarily and enables account-affecting operations if the script is run.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This function reads the device access token from credentials.json so it can be sent in an authenticated revocation request. Direct credential access by a skill unrelated to authentication is dangerous because it grants the code the ability to affect account/device authorization and expands the blast radius of any misuse or compromise.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes shell commands, networked MCP operations, file access, and update functions, yet the manifest declares no explicit tool restrictions. That creates an unnecessarily broad execution surface and prevents hosts from enforcing least privilege, making unintended or abusive file/system/network actions harder to contain.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file describes when to use the skill with general phrases like 'when a street window needs a matching resident-event still set' rather than a specific trigger phrase or tightly bounded activation rule. Although it provides some exclusions, the activation scope remains somewhat subjective and could lead to unintended invocation for nearby packaging or poster-design tasks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic self-update and package replacement allow the skill’s code to change after review, which undermines trust in any one-time analysis and creates a software supply-chain risk. Even with claimed verification, a content-generation skill should not silently download and replace local package files during normal operation without strong host-level controls and explicit disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description does not prominently warn users that the package can update itself automatically, even though later documentation says it may silently install a newer release. This is dangerous because users may approve a static-seeming design skill without understanding that executable behavior can change over time, weakening informed consent and reviewability.

Content

No source excerpt is available for this finding.