ClawHub
Back to skill

Security audit

wechat-article-visual-pack

Security checks for vulnerabilities and agentic risk

Overview

This skill does create WeChat article visuals, but it also grants and uses broad Beatra account authority and silently updates its own package by default.

Install only if you are comfortable granting this package broad Beatra account capabilities and allowing its bundled client to update package files automatically. Consider disabling auto-update with `python3 scripts/mcp_client.py update --auto off`, and use it only in an environment where Beatra account spending and artifact access are acceptable.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/authorize.py:34
Finding

Overprivileged Device Token and Unrestricted MCP Tool Invocation

Content
View full analysis

Vulnerability Details

File Location: scripts/authorize.py:34-37; scripts/mcp_client.py:1463-1481; scripts/mcp_client.py:1490-1497
Vulnerability Type: Violation of least privilege and unrestricted remote tool dispatch
Risk Level: High

Vulnerable Code

python
SCOPE = (
    "mcp:tools artifacts:write images:generate videos:generate music:generate "
    "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel"
)
python
def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]:
    session = _session_with_registration(
        state_dir=Path.home() / ".beatra",
        post_json=_default_post_json,
    )
    if command == "tools":
        return session.request(2, "tools/list", {})
    try:
        arguments = json.load(os.sys.stdin)
    except json.JSONDecodeError as exc:
        raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc
    if not isinstance(arguments, dict):
        raise RuntimeError("Tool arguments on stdin must be one JSON object")
    assert tool_name is not None
    return session.request(
        2,
        "tools/call",
        {"name": tool_name, "arguments": arguments},
    )
python
call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin")
call.add_argument("tool_name")

Technical Analysis

The declared purpose of this Skill is to create WeChat article image packs. Its legitimate operations require image generation, image transformation, image editing, asset upload, model discovery, and limited task retrieval or cancellation.

The authorization request nevertheless includes unrelated privileges for video generation, music generation, speech generation, voice reading and writing, general artifact access, task cancellation, and wallet spending. The bundled client also accepts any MCP tool name supplied on the ...[truncated 1707 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the broad scope with the minimum capabilities required for this image-specific Skill.
  2. Remove video, music, speech, voice-write, and other unrelated permissions.
  3. Reassess whether general wallet:spend is necessary or whether paid image operations can use a narrower image-billing permission.
  4. Add a strict local allowlist before dispatching tools/call. It should contain only:
    • beatra.models.list
    • beatra.assets.upload
    • beatra.images.generate
    • beatra.images.transform
    • beatra.images.edit
    • beatra.tasks.get
    • beatra.tasks.list
    • beatra.tasks.cancel, only following an explicit user request
    • beatra.installations.register, if telemetry remains enabled
  5. Reject unknown tool names before creating an authenticated MCP request.
  6. Where supported, use separate credentials per package or capability instead of one shared full-scope token.
  7. Require explicit confirmation immediately before every billable or destructive operation.

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/mcp_client.py:969
Finding

Default Silent Retrieval and Installation of Remotely Controlled Executable Updates

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:969-1020; scripts/mcp_client.py:1542-1544
Vulnerability Type: Remote payload retrieval and executable package replacement
Risk Level: Medium

Vulnerable Code

python
def maybe_auto_update(
    *,
    state_dir: Path | None = None,
    install_root: Path | None = None,
    get_bytes: GetBytes = _default_get_bytes,
    now: float | None = None,
) -> bool:
    """Best-effort silent update. Never block the requested MCP command."""

    resolved_state = state_dir or Path.home() / ".beatra"
    try:
        resolved_root = (install_root or _current_install_root()).resolve()
        update_home = _update_home(resolved_state, resolved_root)
        observed_at = time.time() if now is None else now
        nonce = _lock_update(update_home, now=observed_at)
        if nonce is None:
            return False
        try:
            recover_update(state_dir=resolved_state, install_root=resolved_root)
            state = _read_update_state(update_home)
            if state.get("auto_update", True) is False:
                return False
            last_checked = state.get("last_checked_at")
            if (
                isinstance(last_checked, (int, float))
                and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS
            ):
                return False
            state["last_checked_at"] = observed_at
            _write_private_json(update_home / "state.json", state)
            checked = check_update(get_bytes=get_bytes)
            if not checked["update_available"]:
                return False
            _ensure_owned_baseline(
                install_root=resolved_root,
                update_home=update_home,
                get_bytes=get_bytes,
            )
            discovery = checked["discovery"]
            manifest, new_files = download_update(disc
...[truncated 3154 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable automatic installation by default. Silent update checks may remain, but executable replacement should require explicit user approval.
  2. Digitally sign the release manifest using an offline-protected release key.
  3. Pin the corresponding verification public key in the audited client and verify the signature before trusting any version, URL, or hash from discovery metadata.
  4. Use key rotation metadata that is itself signed by an already trusted key.
  5. Keep the existing URL restrictions, redirect rejection, archive validation, ownership checks, transactional replacement, and rollback controls.
  6. Display the target version and affected executable files before installation.
  7. Preserve an auditable update log containing version, verified signer identity, timestamp, and file digests without recording credentials.
  8. Consider distributing updates through the same reviewed package registry used to install the Skill rather than implementing in-band executable replacement.

other

Note
Location
scripts/authorize.py:362
Finding

Hostname Collection and Transmission Without an Explicit Opt-In Control

Content
View full analysis

Vulnerability Details

File Location: scripts/authorize.py:362-370; scripts/authorize.py:439-469
Vulnerability Type: Device metadata disclosure
Risk Level: Low

Vulnerable Code

python
def device_display_name() -> str | None:
    """A hostname the user will recognise in the console device list."""
    try:
        name = socket.gethostname().strip()
    except OSError:
        return None
    if not name or not name.isprintable():
        return None
    return name[:120]
python
form: dict[str, str] = {
    "client_id": CLIENT_ID,
    "resource": MCP_URL,
    "scope": SCOPE,
    "platform": host_platform,
    "client_name": PACKAGE_DISPLAY_NAME,
    "external_installation_ref": external_reference,
    "package_version": PACKAGE_VERSION,
    "package_slug": PACKAGE_SLUG,
}
if device_name:
    form["device_name"] = device_name
status, created = post_form(DEVICE_AUTHORIZATION_URL, form)

Technical Analysis

During authorization, the helper calls socket.gethostname, stores the result in ~/.beatra/host.json, and sends it as device_name to the Beatra authorization service. The helper also transmits the detected Agent platform and a stable external installation reference.

This behavior is limited device-identification telemetry rather than broad environment reconnaissance. The audited code does not enumerate IP addresses, FQDNs, network interfaces, users, processes, SSH keys, cloud metadata, or general environment-variable contents. Nevertheless, a hostname can reveal a person's name, employer, project, asset identifier, or internal naming convention.

A hostname is not required to complete OAuth Device Authorization. The user-facing documentation explains platform and installation registration telemetry, but does not provide an explicit option to suppress or replace hostname transmission.

Attack Path

  1. The user runs scripts/authorize.py. 2 ...[truncated 766 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not transmit the system hostname by default.
  2. Use a generic label such as Beatra Skill Device unless the user explicitly chooses a recognizable device name.
  3. Add a command-line option such as --device-name and a privacy-preserving --no-device-name option.
  4. Clearly disclose before authorization that the selected device label, platform, package version, and stable installation reference will be sent to Beatra.
  5. Minimize retention of device metadata and document its retention period and deletion process.
  6. If a stable reference is required, ensure it is scoped to the installation and cannot be used to correlate unrelated services.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documentation indicates behaviors such as uninstall/cleanup, shared credential access, and authorization revocation that are unrelated to producing WeChat article visuals. In context, unrelated account and lifecycle operations hidden inside a creative skill make misuse more dangerous because operators may invoke it in content workflows while unintentionally affecting local installations, credentials, or service access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documentation indicates behaviors such as uninstall/cleanup, shared credential access, and authorization revocation that are unrelated to producing WeChat article visuals. In context, unrelated account and lifecycle operations hidden inside a creative skill make misuse more dangerous because operators may invoke it in content workflows while unintentionally affecting local installations, credentials, or service access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documentation indicates behaviors such as uninstall/cleanup, shared credential access, and authorization revocation that are unrelated to producing WeChat article visuals. In context, unrelated account and lifecycle operations hidden inside a creative skill make misuse more dangerous because operators may invoke it in content workflows while unintentionally affecting local installations, credentials, or service access.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 61)May include surrounding context.

json
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill requests a very broad OAuth scope set, including images, videos, music, speech, voices, task control, artifact access, and wallet spending, which far exceeds the stated purpose of creating a WeChat article visual pack. This violates least privilege and means a compromise, misuse, or deceptive deployment of the skill could grant materially broader account capabilities than users would reasonably expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill requests audio/video generation and voice read/write permissions even though its description is limited to WeChat article visual assets. Unrelated multimodal scopes enlarge the blast radius of credential theft or misuse and indicate over-privileged design inconsistent with user expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file implements broad capabilities unrelated to a visual-pack skill: package self-update, installation inventory, host/platform detection, credential handling, and remote registration telemetry. In the context of a creative content skill, this is dangerous because it materially expands the trust boundary and gives the package persistent code-modification and tracking behaviors that users would not reasonably expect from the advertised function.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The package exposes self-update functionality that can modify its own installed codebase, and other parts of the file trigger update behavior automatically. Self-modifying capability is especially risky in a skill presented as a visual-content helper because it creates a path for remote code evolution after installation, magnifying the consequences of server compromise, release pipeline abuse, or undisclosed feature creep.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

This function reads an access token directly from ~/.beatra/credentials.json so the skill package can perform remote deauthorization. Even though the apparent intent is legitimate uninstall behavior, direct credential handling by a skill expands the attack surface: a modified or trojanized package could reuse the same access path to misuse shared credentials, and this is more sensitive because the skill’s declared purpose is unrelated to authentication management.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python
def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill declares no explicit tool/permission scope even though its documented behavior requires shell, network, file read/write, and environment access via a bundled client. In an agent setting, missing scope boundaries increases the chance the skill can invoke broader host capabilities than users expect, especially when combined with remote calls, local file handling, and updates.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documents automatic self-update and local file replacement behavior that is not necessary for generating a WeChat visual pack. Even if updates are claimed to come from official sources, silent update capability introduces supply-chain and integrity risk in a context where users are expecting content creation, not software modification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json
"icon": "https://beatra.ai/textures/icons/wechat-article-visual-pack-0.1.1.png",
  "localized": {
    "en": {
      "description": "Create a WeChat Official Account visual pack from a finished article, outline, brand assets, photos, or visual references. Produce a lead cover plus coordinated in-article illustrations with clear section focus and consistent visual direction for WeChat articles, WeChat post images, brand stories, product explainers, event recaps, and knowledge content.",
      "display_name": "WeChat Article Visual Pack",
      "summary": "Turn a WeChat Official Account article, outline, or brand imagery into a coordinated lead cover and supporting article-image set.",
      "tags": [

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document states that the client silently checks for and automatically installs newer releases by default, without separate user confirmation. Even with integrity checks and fixed update sources, default silent modification of local package files increases supply-chain and user-consent risk because code can change before ordinary commands run, potentially altering behavior unexpectedly or introducing compromise if the trusted update path is ever breached.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 64)May include surrounding context.

md
the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
  detect completion yourself — never ask the user to confirm in chat that
  they approved.

Approval legitimately takes minutes when sign-in or account creation is

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The document states that the client performs a network registration call and writes a local cache containing installation metadata, but it does not present an explicit user-facing warning, consent mechanism, or clear disclosure of telemetry behavior. Even if the data is described as non-secret and non-billable, silent collection and transmission of package, version, platform, and installation reference can create privacy, compliance, and trust risks, especially in environments that restrict outbound telemetry.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill requests audio/video generation and voice read/write permissions even though its description is limited to WeChat article visual assets. Unrelated multimodal scopes enlarge the blast radius of credential theft or misuse and indicate over-privileged design inconsistent with user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The client performs silent automatic self-updates that can replace installed package files during normal command execution, without a user-facing warning at the time of modification. Even with checksum and manifest validation, this is dangerous because it enables remote code changes in a package that users believe is a content-creation skill, increasing supply-chain risk and reducing user control over executed code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.