Wrong Item Talking Clips

• Outcome: Review
• Latest audit: Sep 6, 2026 · 4:37 PM UTC
• Version: 0.1.3

Overview

The skill appears to be a real Beatra media-generation integration, but it uses broader account authority than the stated clip workflow needs and can silently replace its own installed code.

Review this skill before installing. It is not showing evidence of theft or destructive behavior, but installation links your Beatra account, stores a reusable local token, allows broad Beatra operations through the bundled client, and enables silent package updates by default. Disable auto-updates if you need change control, and install only if you accept the shared Beatra credential model and the broader-than-workflow account scope.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/authorize.py:34
• Finding: Overprivileged Device Token Combined with Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:34-36`; `scripts/mcp_client.py:1438-1468` **Vulnerability Type**: Excessive authorization scope and missing tool allowlist **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` The command dispatcher accepts an arbitrary remote tool name: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The declared Skill workflow requires asset upload, model and voice discovery, optional voice cloning, speech synthesis, video generation, task status access, and limited wallet information. The authorization request additionally includes image generation, music generation, broad voice-writing, wallet spending, and task cancellation. At the same time, the bundled client does not enforce a package-specific allowlist. Any value supplied as `tool_name` is forwarded to the authenticated MCP endpoint through `tools/call`. Consequently, the local client does not prevent the ...[truncated 1911 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope credential with a package-specific, least-privilege token. 2. Remove scopes not required by this Skill, particularly: - `images:generate` - `music:generate` - Broad `voices:write` access unless narrowly required for the optional clone operation - `tasks:cancel` unless cancellation is explicitly enabled for the current workflow 3. Separate wallet read access from spending authority. A read-only balance or ledger operation should not require a general `wallet:spend` capability. 4. Add a strict local allowlist before dispatching `tools/call`. The allowlist should contain only the tools required by the documented workflow, such as: - `beatra.assets.upload` - `beatra.models.list` - `beatra.voices.list` - `beatra.voices.clone` - `beatra.speech.synthesize` - `beatra.videos.animate` - `beatra.tasks.get` - `beatra.tasks.list` - `beatra.tasks.cancel`, only when explicitly justified - Required read-only wallet operations - `beatra.installations.register` 5. Reject unknown tool names locally before creating an authenticated MCP session. 6. Consider separate short-lived capability grants for paid clone, speech, and video stages so approval for one stage cannot authorize unrelated operations. 7. Add automated tests proving that unrelated tools, including music and generic image-generation tools, are rejected locally. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_client.py:1044
• Finding: Windows Credential File Permissions Are Neither Enforced nor Validated<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:119-134`; `scripts/mcp_client.py:1044-1051` **Vulnerability Type**: Inadequate local credential access control on Windows **Risk Level**: Medium ### Vulnerable Code Authorization creates the directory and restricts permissions only on POSIX systems: ```python def _private_directory(path: Path) -> None: # POSIX gets explicit 700/600. On Windows the state directory lives under # the user profile, whose default ACL is already private to the user — # the same posture as gh/aws/gcloud credential stores. The former custom # DACL ceremony was dropped deliberately: its command patterns read as # hostile to agent safety policies and endpoint security, failing installs # while adding no protection an elevated administrator could not bypass. path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` The client reads the token on Windows without checking its effective ACL: ```python def _read_private_credentials(state_dir: Path, path: Path) -> str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` ### Technical Analysis On POSIX systems, the client verifies directory ownership and mode `0700`, verifies file ownership and mode `0600`, requires a regular file, and uses no-follow behavior when opening the credential file. Equivalent controls are absent on Windows. Instead, the implementatio ...[truncated 1901 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Apply an explicit Windows ACL to `~/.beatra` and `credentials.json` when the credential is created. 2. Grant access only to the intended user account and narrowly necessary Windows system principals. 3. Disable or remove unsafe inherited permissions before writing the token. 4. Validate the effective ACL every time the credential is read; fail closed when unauthorized principals have read access. 5. Use supported Windows security APIs rather than shell commands to avoid command-injection and endpoint-security concerns. 6. Detect reparse points and other link-like objects before opening the state directory or credential file. 7. Provide a migration routine that repairs ACLs on existing credential files before accepting them. 8. Update the documentation to distinguish between expected default profile permissions and permissions the application actually verifies. 9. Add Windows-specific tests covering permissive inherited ACLs, shared directories, reparse points, and files owned or controlled by another account. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares no permissions while explicitly instructing use of local file inspection, shell execution, networked MCP calls, and package update behavior. This mismatch prevents informed consent and undermines any sandboxing or policy layer that relies on declared capabilities, making it easier for the skill to access files or perform remote actions beyond what a user would reasonably expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The stated purpose is generating short talking clips, but the skill also describes authentication flows, credential storage, arbitrary local file upload, remote tool invocation, telemetry/registration, uninstall logic, and self-updating package management. That breadth materially exceeds user expectations for a media-generation skill and increases the attack surface for credential misuse, unauthorized data exfiltration, and supply-chain compromise.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill includes an automatic self-update mechanism that downloads and installs newer code, which is unrelated to the core task of creating talking clips. Any self-modifying or self-replacing behavior expands supply-chain risk, because a compromise of the update channel, signing process, or package distribution could silently change the skill's behavior after initial review.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill ships a full OAuth device-authorization and credential-provisioning flow even though the declared skill purpose is generating wrong-item talking clips from images and scripts. That creates a strong functionality mismatch and enables acquisition of a reusable account credential, expanding trust far beyond what a narrowly scoped media skill should need.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The requested OAuth scope includes unrelated high-risk capabilities such as wallet spending, task cancellation, music generation, broad artifact access, and voice write access, none of which are justified by a wrong-item talking-clip workflow. If the credential is abused or the skill is compromised, the attacker gains a much wider blast radius than the feature requires, including potential financial and cross-service impact.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The client embeds a full self-update mechanism and package-discovery flow that are unrelated to producing wrong-item talking clips. Even though the updater has several integrity checks, it still introduces remote code replacement capability into a creative skill, materially increasing supply-chain and post-install tampering risk beyond the stated function of the package.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code records local skill inventory and performs installation registration telemetry on use, persisting data under ~/.beatra despite the skill being presented as a media-generation tool. This creates unnecessary privacy and tracking surface, and normalizes outbound metadata reporting not required for the advertised functionality.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The client fingerprints its hosting environment and injects source_platform and source_package_slug into business tool calls, which is not necessary for generating talking clips. In this context, undisclosed environment attribution increases privacy risk and can aid backend profiling or policy targeting of specific agent runtimes.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The uninstall script manages a shared OAuth device credential and skill inventory for the whole Beatra installation, which is unrelated to the skill’s advertised purpose of generating talking clips from images and scripts. Even if intended for cleanup, this gives the package authority over shared authentication state and other installed skills, expanding trust and attack surface beyond what users would reasonably expect from this skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code performs an outbound network request to revoke a device authorization token during uninstall, a privileged action not justified by the skill’s declared media-generation functionality. A skill package that can trigger credential revocation can deny service to the user or affect other skills sharing the same connection, especially if invoked unexpectedly or repurposed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that newer versions install automatically without separate confirmation, yet this user-impacting behavior is not prominently disclosed in the skill's high-level description. Silent installation changes the executable code and trust boundary without contemporaneous consent, reducing user control and making unexpected or malicious changes harder to detect before execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that the client silently checks for updates and automatically installs newer versions by default before ordinary commands. Even though it describes verification and rollback protections, default silent code replacement without explicit per-update user consent is a security-relevant behavior that can surprise users, change runtime behavior, and expand supply-chain risk if the update channel or signing/verification process is ever compromised.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation states that the bundled client automatically performs an installation registration network call and writes a local cache file, but it does not give an explicit user-facing warning or consent mechanism for that telemetry-like behavior. Even though the data described is limited and non-secret, silent outbound registration and filesystem writes can violate user expectations, create privacy/compliance issues, and be risky in locked-down or sensitive environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The maybe_auto_update path can silently modify installed package files during normal command execution, without a runtime prompt or prominent disclosure. In a skill whose expected role is media generation, silent self-modification is especially risky because users and hosts may not realize executable behavior can change between invocations.

Credential Access

High

• Category: Privilege Escalation

Content

scope = _required_string(polled, "scope")
            if set(scope.split()) != set(SCOPE.split()):
                raise RuntimeError("Beatra authorization returned an unsupported scope")
            credential_path = state_dir / "credentials.json"
            _atomic_json(
                credential_path,
                {

• Confidence: 88% confidence
• Finding: This code persists a bearer access token and related identifiers into a local credentials.json file for later reuse. Storing long-lived reusable credentials materially increases the consequences of local compromise, and in this skill it is especially concerning because the token is minted with overly broad permissions unrelated to the stated media use case.

Credential Access

High

• Category: Privilege Escalation

Content

#: these and then removes the directory only if it is empty — the script
#: never recursively deletes a directory it does not fully understand.
_STATE_FILES = (
    "credentials.json",
    "installation.json",
    "host.json",
    "skills.json",

• Confidence: 88% confidence
• Finding: Referencing credentials.json as part of the files this script may delete indicates the package is aware of and can manipulate shared credential material. In context, the file is not exfiltrated, but granting a media-generation skill access to authentication state is still dangerous because compromise or modification of the script could impact the user’s broader Beatra account connectivity.

Credential Access

High

• Category: Privilege Escalation

Content

def _device_token(state_dir: Path) -> str | None:
    path = state_dir / "credentials.json"
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, ValueError):

• Confidence: 92% confidence
• Finding: The _device_token function reads access_token from credentials.json so the skill can use it in an Authorization header for revocation. This is credential access by the skill package, and although used for a nominal uninstall path rather than theft, it creates a high-value path where a modified or malicious package could reuse the token for unauthorized API actions or account disruption.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 96% confidence
• Finding: The package exposes a self-update capability that can replace its own installed files. Even with checksum and manifest validation, self-modifying application code is a high-risk pattern for a skill unrelated to software maintenance because it broadens the trusted computing base and creates a powerful path for supply-chain compromise or unauthorized behavior changes.

Static analysis

No suspicious patterns detected.