T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:31- Finding
Overprivileged Device Token and Unrestricted MCP Tool Dispatch
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The declared Skill functionality is short-form text-to-speech voiceover generation. Its authorization request nevertheless includes permissions for image generation, video generation, music generation, voice creation or modification, artifact writes, wallet spending, task reads, and task cancellation. The bundled client compounds this excessive scope by accepting an arbitrary `tool_name` and forwarding it to the remote MCP service without a package-specific allowlist. The only effective restriction is therefore whatever the broad bearer token and remote service enforce. The legitimat ...[truncated 1164 chars]- Remediation
View remediation