ClawHub
Back to skill

Security audit

zhongcao-carousel-maker

Security checks for vulnerabilities and agentic risk

Overview

The carousel skill has a coherent creative purpose, but it requests and exposes broader paid Beatra authority than the carousel workflow needs and silently self-updates installed code by default.

Review this before installing. It is not evidence of malware, but it grants a shared Beatra token with spending and non-carousel media permissions, exposes a general Beatra tool-call path, can upload any readable file if directed, and silently updates package code by default. Install only if you trust Beatra and its update channel, disable auto-updates if you require review before code changes, and avoid giving it paths to sensitive local files.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/authorize.py:31
Finding

Excessive authorization scopes combined with unrestricted remote-tool dispatch

Content
View full analysis

Vulnerability Details

File Location: scripts/authorize.py:31-35, scripts/mcp_client.py:1462-1480, scripts/mcp_client.py:1484-1485
Vulnerability Type: Excessive privileges and unrestricted remote tool invocation
Risk Level: High

Vulnerable Code

python
SCOPE = (
    "mcp:tools artifacts:write images:generate videos:generate music:generate "
    "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel"
)
python
def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]:
    session = _session_with_registration(
        state_dir=Path.home() / ".beatra",
        post_json=_default_post_json,
    )
    if command == "tools":
        return session.request(2, "tools/list", {})
    try:
        arguments = json.load(os.sys.stdin)
    except json.JSONDecodeError as exc:
        raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc
    if not isinstance(arguments, dict):
        raise RuntimeError("Tool arguments on stdin must be one JSON object")
    assert tool_name is not None
    return session.request(
        2,
        "tools/call",
        {"name": tool_name, "arguments": arguments},
    )
python
call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin")
call.add_argument("tool_name")

Technical Analysis

The declared Skill functionality requires image generation and editing, artifact upload, model discovery, task management, and a limited set of optional Xiaohongshu research operations. The authorization request nevertheless obtains permissions for unrelated functionality, including video generation, music generation, speech generation, voice read/write access, and wallet spending.

The bundled CLI compounds this excessive authorization by accepting an unrestricted tool_name. It performs no local allowlist check before forwa ...[truncated 1595 chars]

Remediation
View remediation

Remediation Suggestions

  1. Reduce the Device Authorization scope to the minimum operations required by this Skill. Remove video, music, speech, voice-write, and other unrelated permissions.
  2. Avoid granting wallet:spend as a general scope where narrower operation-specific spending authorization is available.
  3. Add a fixed local tool allowlist containing only documented operations, such as:
    • beatra.models.list
    • beatra.images.generate
    • beatra.images.transform
    • beatra.images.edit
    • beatra.assets.upload
    • Required task list/get/cancel operations
    • Installation registration
    • The explicitly documented Xiaohongshu lookup operations
  4. Reject every tool name not present in that allowlist before initializing or contacting the remote service.
  5. Separate optional social research and paid-operation permissions into explicit, purpose-specific grants.
  6. Add tests proving that unrelated media, voice, wallet, and administrative tools cannot be invoked through the packaged client.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mcp_client.py:190
Finding

Arbitrary readable local files can be uploaded to any server-provided HTTPS host

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:190-263, scripts/mcp_client.py:1418-1458, scripts/mcp_client.py:1486-1495
Vulnerability Type: Unrestricted local-file upload and insufficient destination validation
Risk Level: Medium

Vulnerable Code

python
def _read_local_upload(path: Path) -> tuple[str, bytes]:
    candidate = path.expanduser()
    descriptor = -1
    try:
        flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
        descriptor = os.open(candidate, flags)
        before = os.fstat(descriptor)
        if (
            not stat.S_ISREG(before.st_mode)
            or before.st_size < 1
            or before.st_size > MAX_UPLOAD_BYTES
        ):
            raise RuntimeError(
                f"Local upload must be one regular file between 1 and {MAX_UPLOAD_BYTES} bytes"
            )
        with os.fdopen(descriptor, "rb") as handle:
            descriptor = -1
            content = handle.read(MAX_UPLOAD_BYTES + 1)
            after = os.fstat(handle.fileno())
    ...
    return candidate.name, content
python
parsed = urllib.parse.urlsplit(url)
if (
    parsed.scheme != "https"
    or not parsed.hostname
    or parsed.username is not None
    or parsed.password is not None
    or parsed.fragment
):
    raise RuntimeError("Beatra upload instructions are invalid")
python
local_upload = subparsers.add_parser(
    "upload",
    help="Upload one local regular file and print its artifact reference",
)
local_upload.add_argument("path", type=Path)
local_upload.add_argument(
    "--mime-type",
    required=True,
    help="Exact media MIME type, such as image/png, audio/mpeg, or video/mp4",
)

Technical Analysis

The upload command accepts any caller-selected readable regular file of up to 100 MiB. It does not restrict files to the active workspace, approved reference images, expe ...[truncated 1852 chars]

Remediation
View remediation

Remediation Suggestions

  1. Restrict uploads to file types required by the carousel workflow, primarily validated image formats.
  2. Verify file signatures or decode the media instead of trusting a caller-supplied MIME type.
  3. Require an explicit user confirmation that displays the resolved path, file size, detected media type, and upload purpose.
  4. Restrict upload sources to the current workspace or a user-approved set of paths.
  5. Explicitly deny known sensitive paths and file classes, including:
    • ~/.beatra/credentials.json
    • SSH keys
    • .env files
    • Cloud and developer credential stores
    • Browser profiles
    • Operating-system account databases
  6. Allowlist the exact Beatra-controlled upload hostnames expected in upload grants.
  7. Consider opening files relative to a trusted workspace directory and verifying the resolved file remains within that directory.
  8. Add regression tests for sensitive paths, MIME spoofing, symlinks, traversal, and upload URLs hosted outside the approved domain set.

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/mcp_client.py:969
Finding

Default silent updater retrieves and installs remotely mutable executable code without publisher-signature verification

Content
View full analysis

Vulnerability Details

File Location: scripts/mcp_client.py:31-32, scripts/mcp_client.py:334-492, scripts/mcp_client.py:801-1020, scripts/mcp_client.py:1543
Vulnerability Type: Remote payload retrieval and automatic code replacement
Risk Level: Medium

Vulnerable Code

python
PACKAGE_DISCOVERY_URL = "https://beatra.ai/skills/zhongcao-carousel-maker/channels/clawhub/install.json"
PACKAGE_CDN_BASE_TEMPLATE = "https://cdn.beatra.ai/agent-packages/zhongcao-carousel-maker/channels/clawhub/v{version}"
python
manifest_content = get_bytes(
    manifest_url,
    UPDATE_DOWNLOAD_TIMEOUT_SECONDS,
    MAX_UPDATE_MANIFEST_BYTES,
)
if _sha256(manifest_content) != discovery["manifest_sha256"]:
    raise RuntimeError("Beatra update manifest checksum does not match discovery")
...
archive = get_bytes(
    archive_url,
    UPDATE_DOWNLOAD_TIMEOUT_SECONDS,
    MAX_UPDATE_ARCHIVE_BYTES,
)
if _sha256(archive) != discovery["archive_sha256"]:
    raise RuntimeError("Beatra update archive checksum does not match discovery")
return manifest, _validated_archive(archive, manifest_files=manifest_files)
python
def maybe_auto_update(
    *,
    state_dir: Path | None = None,
    install_root: Path | None = None,
    get_bytes: GetBytes = _default_get_bytes,
    now: float | None = None,
) -> bool:
    """Best-effort silent update. Never block the requested MCP command."""
    ...
    state = _read_update_state(update_home)
    if state.get("auto_update", True) is False:
        return False
    ...
    checked = check_update(get_bytes=get_bytes)
    if not checked["update_available"]:
        return False
    ...
    manifest, new_files = download_update(discovery, get_bytes=get_bytes)
    _apply_update(
        install_root=resolved_root,
        update_home=update_home,
        discovery=discovery,
        manifest=manifest,
        new_files=ne
...[truncated 2481 chars]
Remediation
View remediation

Remediation Suggestions

  1. Sign release metadata and package manifests with a publisher key whose public key is pinned in the audited client.
  2. Use a mature update framework such as TUF, or use Sigstore with strict publisher-identity and transparency-log verification.
  3. Ensure the signature covers the package identity, channel, version, manifest digest, archive digest, and expiration metadata.
  4. Disable automatic installation by default. Update checks may remain automatic, but executable replacement should require explicit user approval.
  5. Display the current and proposed versions and identify executable files that will change before installation.
  6. Preserve downgrade and rollback protections while adding protections against freeze and replay attacks.
  7. Consider distributing updates through the host Skill marketplace so the host can repeat static review before activation.
  8. Add tests proving that unsigned, incorrectly signed, expired, replayed, and identity-mismatched releases are rejected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (37)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Uninstall logic, credential/state inspection, device revocation, and local state deletion are administrative functions outside the stated carousel/research purpose. Even if legitimate, bundling them into the same skill increases the chance of unexpected destructive actions on local state and user confusion about what the skill can do.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Uninstall logic, credential/state inspection, device revocation, and local state deletion are administrative functions outside the stated carousel/research purpose. Even if legitimate, bundling them into the same skill increases the chance of unexpected destructive actions on local state and user confusion about what the skill can do.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Uninstall logic, credential/state inspection, device revocation, and local state deletion are administrative functions outside the stated carousel/research purpose. Even if legitimate, bundling them into the same skill increases the chance of unexpected destructive actions on local state and user confusion about what the skill can do.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 69)May include surrounding context.

json
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python
```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The authorization flow requests a very broad OAuth scope set including wallet spending, media generation, artifact/task management, and voice permissions that are not justified by a carousel-making skill. If the token is compromised or the skill misuses it, the excess privileges materially expand blast radius beyond image carousel creation or optional Xiaohongshu research.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

The exposed self-update command enables the skill to replace its own installed code, which is a classic self-modification capability. Even with checksum validation, this is dangerous in a skill whose stated role is content generation, because compromise or misuse of the update infrastructure can transform the skill into an arbitrary code delivery path.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python
)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares no explicit tool scope even though its documented workflow relies on filesystem, network, shell, and environment access via a bundled client. That lack of least-privilege boundaries increases the blast radius if the skill is abused, misconfigured, or updated with malicious behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill advertises automatic self-updating that downloads and installs code unrelated to the core carousel function. Any self-modifying behavior expands the trust boundary beyond the reviewed package and can introduce new capabilities or malicious code after initial approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description does not prominently warn users that the skill may modify local files through unattended updates. Insufficient upfront disclosure undermines informed consent and makes a benign creative skill context more dangerous because users would not reasonably expect local software changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json
"icon": "https://beatra.ai/textures/icons/zhongcao-carousel-maker-0.1.1.png",
  "localized": {
    "en": {
      "description": "Create a Xiaohongshu or REDnote carousel from a post outline, product details, photo set, or style reference. Build an ordered 3:4 image sequence with a hook cover and supporting slides, clear focal imagery, matched visual direction, and headline-safe areas for product recommendations, tutorials, food notes, OOTD, travel guides, knowledge posts, and Xiaohongshu content images for one connected post story. Optionally it reads Xiaohongshu itself — the notes already running for the topic, one page of a note's top comments, and an account's own recent notes — so Xiaohongshu research, competitor note analysis and comment analysis rest on the platform instead of on guesswork.",
      "display_name": "Zhongcao Carousel Maker",
      "summary": "Turn a post outline, product details, photo set, or style reference into an ordered 3:4 Xiaohongshu carousel with a hook cover and coherent supporting slides.",
      "tags": [

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest advertises that the skill can read Xiaohongshu notes, top comments, and an account's recent notes, but it provides no user-facing disclosure about what data is accessed, under what authority, or how it is used. In a research/analysis skill, silent external data access increases privacy and consent risk, especially when account activity and comment data may be analyzed without clear notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Japanese localization repeats the capability to read notes, comments, and recent account activity but omits any warning or consent language around external data access. This creates the same privacy/transparency issue for Japanese-speaking users and can undermine informed consent across locales.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Chinese localization states that the skill can read Xiaohongshu notes and comment pages for analysis, again without any privacy warning or notice about platform data access. Because the skill is specifically positioned for competitor/comment analysis, the lack of disclosure makes unauthorized or unexpected data collection more likely from the user's perspective.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document explicitly states that the client performs silent update checks and automatically installs newer versions without separate confirmation. Even with integrity checks and fixed update sources, modifying local files by default without clear opt-in or prominent warning creates a supply-chain and user-consent risk: a compromised update channel, signing process, or upstream release could lead to unauthorized code changes on the user's system.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 64)May include surrounding context.

md
the user signs in or creates their account there, and the approval page
  continues automatically after sign-in;
- say once that the connection continues automatically after Allow, then
  detect completion yourself — never ask the user to confirm in chat that
  they approved.

Approval legitimately takes minutes when sign-in or account creation is

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation describes an outbound installation-registration call and local cache writes that are unrelated to the skill’s advertised function of carousel generation and Xiaohongshu research. This creates an unnecessary data-flow channel that can collect environment metadata and transmit it off-box without a clear functional need, increasing privacy and supply-chain risk if users do not expect background registration behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.