retail-new-year-pack

• Outcome: Review
• Latest audit: Sep 6, 2026 · 3:43 PM UTC
• Version: 0.1.2

Overview

This music skill is mostly aligned with its purpose, but it asks for broad Beatra account access and can silently update its own files, so it needs careful review before installation.

Install only if you are comfortable granting this package a shared Beatra device token that covers more than music generation and allowing its bundled client to update package files automatically. Before use, consider disabling automatic updates with the documented update --auto off command and avoid invoking arbitrary Beatra tools through the generic call interface.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:34
• Finding: Overprivileged Device Authorization Combined with an Unrestricted Remote Tool Dispatcher## Vulnerability Details **File Location**: `scripts/authorize.py:34-37`; `scripts/mcp_client.py:1460-1476` **Vulnerability Type**: Excessive authorization scope and missing tool allowlist **Risk Level**: High ### Vulnerable Code `scripts/authorize.py:34-37`: ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` `scripts/mcp_client.py:1460-1476`: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill’s declared purpose is to generate a retail playlist of instrumental music. Its legitimate operations require music generation, model lookup, task status retrieval, and limited billing inspection. Nevertheless, the authorization helper requests permissions for unrelated capabilities, including image generation, video generation, speech generation, voice management, artifact writing and reading, wallet spending, and task cancellation. This violates the principle of least privilege. The exposure is amplified by the generic `call` interface, which accepts an arbitrary MCP tool name and forwards it without a package-level allow ...[truncated 2045 chars]
• Remediation: ## Remediation Suggestions 1. Replace the broad authorization scope with the minimum permissions required for this Skill: - Music generation. - Model-card lookup. - Task creation/status retrieval required for generated music. - Read-only wallet access only when the user requests balance or ledger information. - Task cancellation only if cancellation is an intentional, user-confirmed feature. 2. Remove image, video, speech, voice-management, general artifact, upload, and unrelated write permissions from this package’s default authorization profile. 3. Add a strict local allowlist before dispatching `tools/call`. The allowlist should contain only documented tools, such as: - `beatra.models.list` - `beatra.music.generate` - `beatra.tasks.get` - `beatra.tasks.list` - `beatra.wallet.get` - `beatra.wallet.ledger` - Any explicitly required cancellation tool, guarded by direct user confirmation 4. Reject all unrecognized tool names before establishing or using an authenticated session. Do not rely exclusively on server-side authorization. 5. If upload or other media capabilities are needed by future workflows, place them in separate packages or authorization profiles and request those scopes only after explicit, contextual user consent. 6. Add automated tests verifying that: - Every allowed tool is necessary for the declared workflow. - Unrelated tool names are rejected locally. - Read-only actions cannot invoke spending or write capabilities. - Scope changes fail review when they introduce capabilities not represented in the Skill documentation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares itself as a simple playlist generator, but its instructions require shell execution, local file access, environment access, network calls, and file modification through a bundled client. That creates a materially larger trust boundary than the manifest implies, making it easy for a host or user to invoke sensitive capabilities without informed consent or proper sandboxing.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior goes far beyond the stated purpose of generating a retail New Year instrumental playlist: it includes authentication flows, persistent credential storage, remote tool invocation, uploads, telemetry/registration, auto-update, and uninstall/token-revocation logic. This mismatch is dangerous because users may authorize a seemingly low-risk creative skill while unknowingly granting a broad remote-management and code-update surface.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that the bundled client silently checks for and installs newer releases automatically without separate confirmation. Even with integrity checks claimed in the text, silent self-update materially increases supply-chain risk because future code can change behavior, permissions, or exfiltration capability after initial review, and the warning is easy to miss in a music-playlist skill.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer versions before ordinary commands, without requiring separate confirmation at execution time. Even with integrity checks and rollback protections, this is a system-modifying action that can surprise users, weaken change-control expectations, and increase risk if the update channel or signing process is ever compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document states that the client automatically sends installation metadata and writes a local cache file on first use, but it does not clearly warn users or require explicit consent for that behavior. Even though the data is described as non-secret and non-billable, silent telemetry and filesystem writes can violate user expectations, privacy requirements, or enterprise policy, especially in agent environments handling regulated or sensitive deployments.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The client performs silent automatic self-updates and writes new package files during normal execution without a user-facing prompt. Even though the updater includes substantial integrity checks, this still expands the trusted computing base to remote content and can unexpectedly alter executable behavior; if the update channel or signing/distribution path is compromised, code execution follows on the next run.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 74% confidence
• Finding: This code persists a long-lived bearer access token in plaintext JSON on disk under the user's home directory. Although POSIX permissions are tightened, plaintext token storage remains sensitive: any local compromise, permissive backup/sync tooling, or weaker Windows ACL assumptions could expose the token and allow unauthorized use of the broad granted scopes.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 90% confidence
• Finding: The package includes first-class self-modification capability through its self-update path, allowing the skill to replace its own installed files. In an agent skill context this is sensitive because it lets remotely fetched content change executable code after installation; compromise of the update source, CDN, or release process could turn a trusted skill into a persistence or execution vector.

Static analysis

No suspicious patterns detected.