T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/authorize.py:34- Finding
Overbroad Shared Authorization Scope and Unrestricted MCP Tool Invocation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/authorize.py:34-36;scripts/mcp_client.py:1463-1480
Vulnerability Type: Excessive privileges and unrestricted privileged tool dispatch
Risk Level: HighVulnerable Code
scripts/authorize.py:34-36:python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" )scripts/mcp_client.py:1463-1480:python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, )Technical Analysis
The Skill's declared workflow requires text-based script production and, when explicitly requested, image generation, speech synthesis, model discovery, voice listing, and task management. However, the authorization request includes unrelated capabilities such as video generation, music generation, voice modification, general artifact writing, wallet spending, and task cancellation.
The bundled client compounds this excessive scope by accepting an arbitrary
tool_namefrom the command line and forwarding it to the remotetools/callmethod without a package-specific allowlist. Every such call is authenticated with the share ...[truncated 1984 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the shared full-scope token with a package-specific credential restricted to the minimum capabilities required by this Skill.
- Remove unrelated scopes, particularly:
videos:generatemusic:generatevoices:write- Any general artifact or wallet scope not strictly required by the documented workflow
- Implement a local allowlist before dispatching
tools/call. Permit only the explicitly documented tools, such as model listing, voice listing, image generation, speech synthesis, necessary task inspection, installation registration, and user-requested cancellation. - Reject unknown tool names before creating an authenticated session or transmitting a request.
- Separate read-only, generation, spending, and cancellation privileges into distinct credentials or narrowly scoped authorization grants.
- Require explicit user confirmation immediately before each paid operation, and enforce the confirmation in code rather than relying only on Skill instructions.
- Apply server-side package restrictions so that
source_package_slugis validated and cannot invoke tools outside the package's approved capability set. - Avoid sharing a single broad token across unrelated Skills. If sharing is unavoidable, issue attenuated per-package tokens derived from the device authorization.
- Add automated tests proving that unsupported tool names and capabilities are rejected locally and remotely.