T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Over-Privileged Shared Bearer Token and Unrestricted MCP Tool Dispatch
- Content
View full analysis
- Remediation
View remediation
Security audit
wealth-cover-set
Security checks for vulnerabilities and agentic risk
Overview
The cover-image workflow is disclosed, but the package also uses broad Beatra account authority and silent self-updating code, so it should go through Review.
Review before installing. The skill appears intended to generate Beatra cover images, but installing it means trusting a broad shared Beatra device token, generic MCP tool dispatch, selected-file uploads through Beatra-provided destinations, and automatic replacement of the package's own code. Disable automatic updates if you need reviewed code to remain fixed, and use it only with a Beatra account where the broad media and wallet permissions are acceptable.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:1031- Finding
Silent Remote Replacement of Executable Skill Code Without Independent Release Signatures
- Content
View full analysis
dict[str, Any]: discovery = _json_object( get_bytes( _discovery_url(), UPDATE_DISCOVERY_TIMEOUT_SECONDS, MAX_UPDATE_DISCOVERY_BYTES, ), "Beatra update discovery", ) current = _semver(PACKAGE_VERSION) available = _semver(discovery.get("version")) _release_urls(discovery) if available < current: raise RuntimeError("Beatra update discovery attempted a version downgrade") return { "current_version": PACKAGE_VERSION, "available_version": discovery["version"], "update_available": available > current, "discovery": discovery, } ``` Hashes are checked, but the hashes themselves originate from the same remote discovery chain: ```python manifest_content = get_bytes( manifest_url, UPDATE_DOWNLOAD_TIMEOUT_SECONDS, MAX_UPDATE_MANIFEST_BYTES, ) if _sha256(manifest_content) != discovery["manifest_sha256"]: raise RuntimeError("Beatra update manifest checksum does not match discovery") ``` Ordinary commands trigger the updater automatically: ```python else: maybe_auto_update() ``` The project explicitly documents that installation occurs silently and without separate confirmation: ```markdown When a newer version is available, it installs automatically without separate confirmation. ``` ### Technical Analysis The implementation contains meaningful safeguards: HTTPS is required, redirects are rejected, CDN paths are constrained, archive members are validated, extraction limits are en ...[truncated 2529 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:223- Finding
Remote MCP Response Can Direct User-Selected File Uploads to Any HTTPS Host
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:1100- Finding
Windows Credential Confidentiality Relies on Unverified Inherited ACLs
- Content
View full analysis
str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` Credential creation similarly restricts permissions only on POSIX systems: ```python def _private_directory(path: Path) -> None: path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` This conflicts with the documented guarantee: ```markdown On Windows the current user must be the only principal granted access through the file ACL. ``` ### Technical Analysis On POSIX systems, the implementation verifies that the state directory is owned by the current user with mode `0700` and that the credential is a user-owned regular file with mode `0600`. It also uses `O_NOFOLLOW` when available. On Windows, the implementation assumes that the user profile's inherited ACL is private. It neither creates an explicit user-only discretionary ACL nor verifies existing access-control entries before writing or reading the bearer token. Default profile permissions may be adequate on many standard installations, but they are not equivalent to an enforced security invarian ...[truncated 1526 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (38)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated cover-generation purpose does not prepare the user for uninstall flows, inspection of installed skill inventory, access to ~/.beatra state and credentials, token revocation, and deletion of local files. These are privileged lifecycle operations that can alter local system/application state and affect account access, so hiding them behind a creative-media skill materially increases user surprise and operational risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated cover-generation purpose does not prepare the user for uninstall flows, inspection of installed skill inventory, access to ~/.beatra state and credentials, token revocation, and deletion of local files. These are privileged lifecycle operations that can alter local system/application state and affect account access, so hiding them behind a creative-media skill materially increases user surprise and operational risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's stated cover-generation purpose does not prepare the user for uninstall flows, inspection of installed skill inventory, access to ~/.beatra state and credentials, token revocation, and deletion of local files. These are privileged lifecycle operations that can alter local system/application state and affect account access, so hiding them behind a creative-media skill materially increases user surprise and operational risk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Submit once through bundled `scripts/mcp_client.py`. Poll
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The manifest explicitly references a local bearer credential file at ~/.beatra/credentials.json for MCP authentication. While using credentials is expected, binding the skill to a concrete local credential path increases the chance of unintended credential exposure or misuse if the skill runtime, logs, or downstream tooling expose filesystem paths or permit unauthorized access to MCP-backed actions.
- Content
json }, "mcp": { "authentication": "device-bearer", "credential_file": "~/.beatra/credentials.json", "name": "beatra", "transport": "streamable-http", "url": "https://mcp.beatra.ai/mcp"
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The bundled MCP client is documented as a general remote invocation interface supporting tool discovery and arbitrary tools/call execution, which is far broader than a narrowly scoped cover-generation skill requires. In a skill package, this creates a capability escalation path where the installed credential can be used to access unexpected remote functions, especially if other files or prompts later instruct the agent to call them.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The OAuth scope request is dramatically broader than the skill’s stated purpose of generating a still cover set. In addition to image/artifact access, it requests wallet spending, music/video/speech generation, voice read/write, and task cancellation, which violates least privilege and would grant the skill account capabilities unrelated to its advertised function if the credential were later misused or the skill expanded maliciously.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This helper obtains authorization for financially and operationally sensitive capabilities that are unjustified by a wealth cover image-set tool. The inclusion of wallet spending is especially dangerous because compromise, misuse, or later code changes could convert a simple media skill into one that incurs charges or accesses unrelated services under a user-approved token.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This client contains broad non-functional behaviors—self-update, installation registration, host platform detection, local inventory recording, and credential handling—that substantially exceed the stated purpose of generating wealth-cover still sets. In a skill context, such hidden system-management and telemetry behavior increases attack surface and trust risk because the package can alter itself and report environment metadata unrelated to the user-facing task.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code downloads manifests and archives and then replaces files under its own installation root, including silent update paths via maybe_auto_update(). Even with checksum and path validations, self-modifying code is dangerous in a content-generation skill because compromise of the vendor update channel, signing process, or discovery origin would yield arbitrary code replacement on the host.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The exposed CLI includes an update command for self-updating behavior, confirming that this package is designed to modify its own installed code. Self-modification is high risk in a narrowly scoped skill because it creates an unnecessary route from remote content delivery to local code execution if the update trust chain is ever subverted.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script hard-codes a remote authorization origin and revocation endpoint for shared device credentials, functionality that is unrelated to the stated purpose of generating cover stills. Even if intended as package lifecycle logic, embedding credential-revocation behavior in a creative media skill expands the trust boundary and gives the skill the ability to affect other installed skills by touching shared authentication state.
- Content