T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Overprivileged Shared Bearer Credential and Unrestricted MCP Tool Dispatch
- Content
View full analysis
- Remediation
View remediation
Security audit
Unit Map Page
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do its advertised classroom image-generation job, but it asks for and can use broader Beatra account authority than that job requires and can silently replace its own files.
Install only if you are comfortable giving this Beatra package a shared, reusable account token with authority beyond still-image generation, including other media and wallet-spend scope. Disable automatic updates with scripts/mcp_client.py update --auto off if you need reviewed code to stay fixed, and avoid approving the device authorization on machines where other local users or processes could read your profile files.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:941- Finding
Silent Remote Replacement of Executable Package Files Without Independent Release Signatures
- Content
View full analysis
bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked[" ...[truncated 3385 chars]- Remediation
View remediation
other
Warning
- Location
scripts/authorize.py:340- Finding
Unnecessary Collection, Persistence, and Transmission of Host Identification Data
- Content
View full analysis
str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The values are included in the device-authorization request: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: for ...[truncated 2100 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:1044- Finding
Windows Credential File Permissions Are Neither Created Nor Validated
- Content
View full analysis
str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` Directory and file restriction helpers enforce explicit permissions only on POSIX: ```python def _private_directory(path: Path) -> None: path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` ### Technical Analysis The bearer credential grants substantial application authority. On POSIX, the client verifies directory ownership and exact `0700/0600` permissions and uses no-follow file opening. On Windows, equivalent checks are absent. A profile directory often has a reasonably restrictive default ACL, but this is not a reliable security invariant. ACLs can be inherited from a modified parent, copied from another location, relaxed by deployment tools, or deliberately altered. The file can also potentially be represented through a reparse point or other unexpected filesystem object because `Path.read_text()` performs no explicit object-type or ...[truncated 1385 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (35)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The scope set includes videos:generate, music:generate, speech:generate, voices:read, and voices:write even though the skill is described as producing still mind map pages. These unrelated capabilities expand what the skill can do if compromised or repurposed and are not justified by the advertised use case.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill also references uninstall/disconnect workflows that read and modify local application state, access credential files, contact remote APIs to revoke authorization, and delete package state. Embedding system-management behavior in a skill advertised for producing classroom graphics increases the chance of unexpected destructive actions and makes the overall package harder to audit safely.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill also references uninstall/disconnect workflows that read and modify local application state, access credential files, contact remote APIs to revoke authorization, and delete package state. Embedding system-management behavior in a skill advertised for producing classroom graphics increases the chance of unexpected destructive actions and makes the overall package harder to audit safely.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill also references uninstall/disconnect workflows that read and modify local application state, access credential files, contact remote APIs to revoke authorization, and delete package state. Embedding system-management behavior in a skill advertised for producing classroom graphics increases the chance of unexpected destructive actions and makes the overall package harder to audit safely.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The changelog mentions balance and ledger calls, which are financially sensitive capabilities unrelated to generating classroom unit maps. This strong mismatch suggests hidden account or payment functionality that could be used to inspect billing data or facilitate unauthorized financial actions under the cover of a benign educational tool.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Referencing a local credential file for device-bearer authentication means the skill is configured to operate with reusable account credentials. In the context of a simple map-generation skill, this is unnecessarily powerful and increases the risk of credential misuse, unauthorized API access, and exposure of account-linked data if the remote MCP server is abused or overprivileged.
- Content
json }, "mcp": { "authentication": "device-bearer", "credential_file": "~/.beatra/credentials.json", "name": "beatra", "transport": "streamable-http", "url": "https://mcp.beatra.ai/mcp"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The requested OAuth scope set is far broader than the stated function of generating still unit mind map pages. It includes media-generation, task control, artifact access, and wallet-related permissions, so if the credential is issued or later misused, the skill gains authority well beyond its educational purpose, violating least privilege and increasing blast radius.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The scope set includes videos:generate, music:generate, speech:generate, voices:read, and voices:write even though the skill is described as producing still mind map pages. These unrelated capabilities expand what the skill can do if compromised or repurposed and are not justified by the advertised use case.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This client contains broad self-update and installation telemetry functionality that is unrelated to the advertised classroom unit-map purpose. The update path downloads and replaces package files at runtime, materially expanding the trust boundary from local skill logic to remote discovery, manifest, and archive infrastructure; if that supply chain is compromised, arbitrary package code can be deployed locally.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code fingerprints the host environment and persistently records installation/usage metadata in local files and sends registration telemetry to a remote service. For a classroom mapping skill, this data collection is unnecessary and increases privacy and tracking risk, especially because it is performed automatically and best-effort on normal operations rather than behind explicit user consent.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The skill includes built-in self-modification through an update command and background auto-update logic, allowing it to replace its own installed files. Self-modifying capability is especially risky in a skill whose stated purpose is simple content generation, because it creates a persistent code execution and supply-chain expansion path unrelated to the business function.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is described as generating unit mind-map pages, but the uninstall script manages a shared device connection, evaluates other installed skills, and may revoke remote authorization. Those actions are security-sensitive and materially exceed what is justified by the skill's stated classroom content purpose, creating a supply-chain style trust boundary violation if users install the skill expecting only local content generation.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The script explicitly targets credentials.json and other shared state files for deletion as part of uninstall. For a unit-map skill, access to shared credential material is unnecessary and dangerous because compromise, misuse, or logic errors in this package can affect authentication state beyond the package itself.
- Content
python #: these and then removes the directory only if it is empty — the script #: never recursively deletes a directory it does not fully understand. _STATE_FILES = ( "credentials.json", "installation.json", "host.json", "skills.json",
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code performs network-capable token revocation and deletes shared local state files under ~/.beatra, including credentials and installation metadata. Even though the code tries to be conservative, bundling credential lifecycle control into a content-oriented skill increases the blast radius of uninstall and enables unintended denial of service or credential interference affecting other skills on the device.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The _device_token function reads an access token from shared credentials.json for use in remote revocation. Reading bearer tokens inside a skill package is highly sensitive and unjustified by the manifest's educational mapping purpose; if abused or extended, it could enable unauthorized API actions or account/device disruption.
- Content
python def _device_token(state_dir: Path) -> str | None: path = state_dir / "credentials.json" try: value = json.loads(path.read_text(encoding="utf-8")) except (OSError, ValueError):
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool scope even though its instructions invoke shell, local file access, networked APIs, and package update behavior. Without a restrictive allowlist, a host or agent may grant broader capabilities than users expect, increasing the blast radius for misuse or prompt-injection-driven actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes an automatic self-update mechanism that can download and replace local package files, which is unrelated to generating mind-map images and expands the trust boundary to remote update infrastructure. Even with verification claims, silent code replacement creates a supply-chain risk and can change behavior after review, undermining user expectations and static analysis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation says newer versions install automatically without separate confirmation, but this material behavior is not disclosed in the top-level summary where users decide whether to invoke the skill. Hidden silent updates reduce informed consent and can expose users to changed code paths, permissions, or network behavior after they approved an earlier version.
- Content