Security audit

suno-lyrics-to-song

Security checks for vulnerabilities and agentic risk

Overview

This lyrics-to-song skill has a coherent music workflow, but it also grants broad Beatra account powers and silently updates its own executable files, so it needs careful review before installation.

Install only if you are comfortable giving Beatra a broad shared device authorization that may spend credits and access multiple media/task capabilities, and if you accept silent package updates. Disable automatic updates with the documented --auto off command if you require reviewed code to stay fixed, and avoid using the generic upload or arbitrary tool-call paths with sensitive local files or unrelated Beatra tools.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/mcp_client.py:969
Finding: Silent Self-Update Permits Remote Replacement of Executable Skill Code
Content: View full analysis
bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( ...[truncated 2957 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/authorize.py:34
Finding: Music Skill Requests Broad Cross-Media and Spending Privileges
Content: View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared purpose is to turn lyrics into a Suno music track. Nevertheless, authorization requests permissions for image generation, video generation, speech generation, voice reading and writing, artifact writing, task cancellation, and wallet spending. The client does not enforce a package-specific allowlist of MCP tool names. Any tool exposed by the server and accepted by the broad bearer token can be selected through `scripts/mcp_client.py call `. This breaks least privilege at both the credential and local dispatch layers. The documentation discloses that one approval covers several media categories, but disclosure does not make those permissions technically necessary ...[truncated 983 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mcp_client.py:231
Finding: Generic Local-File Upload Can Send Sensitive Files to a Server-Selected Host
Content: View full analysis
tuple[str, bytes]: candidate = path.expanduser() descriptor = -1 try: flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) descriptor = os.open(candidate, flags) before = os.fstat(descriptor) if ( not stat.S_ISREG(before.st_mode) or before.st_size < 1 or before.st_size > MAX_UPLOAD_BYTES ): raise RuntimeError( f"Local upload must be one regular file between 1 and {MAX_UPLOAD_BYTES} bytes" ) with os.fdopen(descriptor, "rb") as handle: descriptor = -1 content = handle.read(MAX_UPLOAD_BYTES + 1) after = os.fstat(handle.fileno()) ``` ```python def _complete_upload( result: dict[str, Any], *, mime_type: str, content: bytes, put_bytes: PutBytes, ) -> dict[str, str]: structured = result.get("structuredContent") instruction = structured.get("upload") if isinstance(structured, dict) else None if not isinstance(instruction, dict) or instruction.get("method") != "PUT": raise RuntimeError("Beatra upload instructions are invalid") url = instruction.get("url") headers = instruction.get("headers") if not isinstance(url, str) or not isinstance(headers, dict): raise RuntimeError("Beatra upload instructions are invalid") parsed = urllib.parse.urlsplit(url) if ( parsed.scheme != "https" or not parsed.hostname or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise RuntimeError("Beatra upload instructions are invalid") ... response = put_bytes(url, dict(headers ...[truncated 2391 chars]
Remediation: View remediation

other

Note

Location: scripts/authorize.py:338
Finding: Authorization Collects and Transmits Hostname and Agent-Environment Telemetry
Content: View full analysis
str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEVICE_AUTHORIZATION_URL, form) ``` ### Technical Analysis During authorization, the code inspects e ...[truncated 1640 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mcp_client.py:1044
Finding: Windows Credential File Permissions Are Neither Created nor Verified as Private
Content: View full analysis
None: # POSIX gets explicit 700/600. On Windows the state directory lives under # the user profile, whose default ACL is already private to the user — # the same posture as gh/aws/gcloud credential stores. path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` ```python def _read_private_credentials(state_dir: Path, path: Path) -> str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") if os.name != "posix": raise RuntimeError("Beatra credential permissions are unsupported on this platform") ``` The corresponding documentation claims stronger protection: ```text On Windows the current user must be the only principal granted access through the file ACL. ``` ### Technical Analysis On POSIX systems, the code explicitly enforces `0700` on the state directory and `0600` on credential files, verifies ownership, rejects symlinks, and fails closed when permissions are unsafe. On Windows, it simply relies on inherited profile ACLs and reads the token without checking the file owner or discretionary access-control list. Inherited permissions are environment-dependen ...[truncated 1330 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The same skill surface also covers uninstall/disconnect behavior, modification of ~/.beatra state, inventory inspection, authorization revocation, and deletion of local credential/configuration files. Combining destructive lifecycle operations with a benign creative workflow creates a dangerous description-behavior mismatch and broadens the chance of accidental or abusive state changes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The same skill surface also covers uninstall/disconnect behavior, modification of ~/.beatra state, inventory inspection, authorization revocation, and deletion of local credential/configuration files. Combining destructive lifecycle operations with a benign creative workflow creates a dangerous description-behavior mismatch and broadens the chance of accidental or abusive state changes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The same skill surface also covers uninstall/disconnect behavior, modification of ~/.beatra state, inventory inspection, authorization revocation, and deletion of local credential/configuration files. Combining destructive lifecycle operations with a benign creative workflow creates a dangerous description-behavior mismatch and broadens the chance of accidental or abusive state changes.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
Use only this Skill's bundled `scripts/mcp_client.py` for every remote MCP

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
Use only this Skill's bundled `scripts/mcp_client.py` for every remote MCP

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
Use only this Skill's bundled `scripts/mcp_client.py` for every remote MCP

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
Use only this Skill's bundled `scripts/mcp_client.py` for every remote MCP

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · manifest.json (reported line 70)May include surrounding context.
json
``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.
text
They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.
text
They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.
text
They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.
text
They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.
python
``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.
python
``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.
python
``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.
python
``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The authorization scope is far broader than the stated purpose of a lyrics-to-song skill. In addition to music generation, it requests images, videos, speech, voice read/write, artifact/task controls, and wallet spending, which violates least-privilege and would let a compromised or abusive skill act well beyond user expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The client embeds a full remote self-update and installation-management mechanism that is unrelated to the stated lyrics-to-song workflow. Even though the implementation includes integrity checks, it still grants the operator ongoing ability to replace local code and behavior after installation, materially expanding the trust boundary and creating a supply-chain style execution risk inappropriate for a creative skill.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: Exposing self-update functionality in a skill client gives the package the ability to replace its own code independently of the host's normal trust and review model. In a lyrics-to-song context this is especially suspicious because the capability is unrelated to user-facing functionality and creates a durable path for post-installation code changes.
Content: Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.
python
) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This function opens and parses ~/.beatra/credentials.json to extract an access token, giving the skill direct access to a shared authentication secret. Even though the visible use is revocation rather than exfiltration, direct token access from a lyrics-focused skill is dangerous because any compromise or modification of the package would let an attacker reuse or leak the credential.
Content: Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.
python
def _device_token(state_dir: Path) -> str | None: path = state_dir / "credentials.json" try: value = json.loads(path.read_text(encoding="utf-8")) except (OSError, ValueError):

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill declares no explicit tool scope while its documented behavior implies access to shell, network, local files, and environment data via the bundled client and update flow. Missing least-privilege boundaries makes it harder for the host or user to understand and constrain what the skill can do, increasing the blast radius if the skill is compromised or misused.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly allows silent automatic updates that download and replace local package files without separate confirmation during ordinary command execution. Any self-modifying mechanism in a skill materially increases supply-chain risk; if the update channel, signing, or package identity checks fail or are bypassed, the skill can become a code-delivery path with little user visibility.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file states that 'Canonical English installations stay on canonical/en, and SkillHub Chinese installations stay on skillhub/zh-CN.' This hard-codes locale/channel behavior and does not indicate that the user can choose or override the language/locale, which matches the policy's language/locale violation criteria.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · manifest.json (reported line 9)May include surrounding context.
json
"icon": "https://beatra.ai/textures/icons/suno-lyrics-to-song-0.1.1.png", "localized": { "en": { "description": "Turn complete lyrics, a rough lyric draft, loose lines, or an existing hook into a structured, listenable Suno song. This Suno lyrics-to-song workflow works as an AI song generator from lyrics and AI music generator from lyrics: choose Preserve mode to keep every original line or Refine mode to improve rhythm, rhyme, singability, and hook strength. Build the song structure across verses, chorus, bridge, and purposeful repetition, then create a style prompt for music with genre, mood, arrangement, and vocal direction for Suno custom lyrics. Use it to turn lyrics into a song, make a song from lyrics, convert lyrics to music, get help from a lyrics songwriting assistant, or take rough lyrics to song-ready form through a custom lyrics-to-song process.", "display_name": "Suno Lyrics to Song", "summary": "Turn complete lyrics, rough drafts, loose lines, or a hook into a structured Suno song with custom lyrics, clear sections, style, mood, arrangement, and vocal direction.", "tags": [

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document states that the client silently checks for updates and automatically installs newer releases without separate confirmation. Even with strong integrity controls described later, silent self-modifying behavior can unexpectedly change local files and execution behavior, creating user-consent and operational-risk concerns if updates introduce regressions or occur in sensitive environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.