T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:34
- Finding
- Overprivileged Shared OAuth Token and Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:34-37`; `scripts/mcp_client.py:1477-1488` **Vulnerability Type**: Excessive authorization scope and unrestricted privileged tool selection **Risk Level**: High ### Vulnerable Code ```python # scripts/authorize.py:34-37 SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python # scripts/mcp_client.py:1477-1488 call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ... elif args.command in {"tools", "call"}: result = _run_command(args.command, getattr(args, "tool_name", None)) ``` ```python # scripts/mcp_client.py:1465-1474 assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill's declared purpose is to generate classroom mind-map images from user-supplied content. Its legitimate requirements include image generation, optional reference-image upload, model discovery, task management, and billing operations. The authorization helper nevertheless requests permissions for unrelated capabilities, including: - Video generation - Music generation - Speech generation - Voice-resource reading and writing - General artifact access - Wallet spending - Task cancellation In addition, the bundled MCP client accepts an arbitrary `tool_name` from the command line and forwards it to the remote MCP server. It does not enforce a package-specific allowlist matching the operations documented in `SKILL.md`. Although the token is shared among Beatra packages, that architecture does not provide least privilege for this individual Skill. A compromised or incorrectly instructed Agent can use this package's generic client to invoke operations unrelated to unit-map image generation. ### ...[truncated 1561 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope token with a package-specific, least-privilege credential. 2. Request only the capabilities required by this Skill, such as: - Image generation and editing - Model-card lookup - Explicit reference-file upload - Necessary artifact reads - Task reads and user-requested cancellation - Minimum required billing or wallet operations 3. Remove video, music, speech, and voice-write scopes unless a separately installed Skill explicitly requires them. 4. Add a local allowlist in `mcp_client.py` for this package. Reject all tool names outside the documented set before reading or using the credential. 5. Separate read-only and billable permissions where supported. Do not grant wallet spending merely because wallet balance or ledger reads are required. 6. Require explicit user confirmation immediately before every billable tool invocation, independent of the Skill's natural-language instructions. 7. Bind authorization grants to the package identifier and enforce that binding server-side so another package cannot reuse the credential for unrelated operations. 8. Log non-secret authorization decisions and rejected tool names for auditability without logging prompts, bearer tokens, or sensitive user content. ]]>