T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Authorization Requests Permissions Beyond the Skill's Functional Requirements
- Content
View full analysis
- Remediation
View remediation
Security audit
YouTube Lesson Card Set
Security checks for vulnerabilities and agentic risk
Overview
The skill’s main caption-to-card workflow is coherent, but it asks for broad Beatra account permissions and silently self-updates executable code by default.
Review this before installing if you are not comfortable granting a shared Beatra device token with broad media, wallet, artifact, and task permissions. Disable automatic updates with `python3 scripts/mcp_client.py update --auto off` if you want approval before package code changes, and revoke the device from the Beatra Console if you later decide to disconnect it.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
scripts/mcp_client.py:969- Finding
Default Silent Update Mechanism Retrieves and Installs Changeable Remote Code
- Content
View full analysis
bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update ...[truncated 3913 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (44)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The requested permissions include images, videos, music, speech, and voice read/write capabilities that do not align with turning public YouTube lesson captions into text takeaway cards. These excessive privileges broaden the attack surface and could enable misuse of user resources or unauthorized actions through the shared credential.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Including uninstall lifecycle actions, token revocation, inspection of installed-skill inventory, and deletion/modification of local state files is outside the stated lesson-card function. These behaviors are sensitive because they can alter account access and local application state, and they are easy to under-review when hidden inside a content-production skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Including uninstall lifecycle actions, token revocation, inspection of installed-skill inventory, and deletion/modification of local state files is outside the stated lesson-card function. These behaviors are sensitive because they can alter account access and local application state, and they are easy to under-review when hidden inside a content-production skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Including uninstall lifecycle actions, token revocation, inspection of installed-skill inventory, and deletion/modification of local state files is outside the stated lesson-card function. These behaviors are sensitive because they can alter account access and local application state, and they are easy to under-review when hidden inside a content-production skill.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md inspection (`scripts/mcp_client.py` / `beatra.assets.upload`). Keep
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation states that one approval grants access to image, video, music, speech, upload, model, and task tools, which is far broader than what a YouTube caption-to-cards skill should need. This creates a strong scope mismatch and violates least privilege, increasing the blast radius if the skill or its backend is abused or compromised.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documented authorization explicitly covers multiple unrelated media and task tools despite the skill being described as a caption summarization/card generation utility. Overbroad capability grants enable unnecessary access paths and make lateral misuse more feasible if credentials are stolen, reused, or the service behavior changes.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Static analysis
No suspicious patterns detected.