zhongcao-food-note-maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:16 AM UTC
• Version: 0.1.2

Overview

The skill mostly matches its food-post purpose, but it should be reviewed because it silently installs code updates and asks for broader Beatra permissions than the food-image workflow needs.

Install only if you are comfortable granting Beatra a shared device token with broader media and spending permissions than this specific food-image skill needs. Consider disabling automatic updates with `python3 scripts/mcp_client.py update --auto off`, review Beatra account charges, and revoke the device from the Beatra Console if you stop using it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/mcp_client.py:969

Finding

Silent Automatic Updates Permit Post-Audit Remote Code Replacement

Content

View full analysis

bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( ...[truncated 3875 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/authorize.py:35

Finding

Device Authorization Requests Capabilities Unrelated to Food-Note Generation

Content

View full analysis

Remediation

View remediation

other

Note

• Location: scripts/authorize.py:340

Finding

Hostname and Agent-Environment Metadata Are Collected and Transmitted

Content

View full analysis

str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The collected hostname is transmitted during device authorization: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEVICE_AUTHORIZATION_URL, form) ``` The detec ...[truncated 2543 chars]

Remediation

View remediation

`. 3. Clearly disclose every transmitted metadata field before starting device authorization. 4. Provide command-line controls such as `--device-name`, `--no-device-name`, and `--no-source-attribution`. 5. Avoid persisting the hostname unless the user explicitly enables recognizable device labels. 6. Continue limiting platform detection to narrow signatures; do not enumerate or transmit unrelated environment variables. 7. Define retention, deletion, and correlation policies for installation telemetry. 8. Ensure telemetry fields are never required for creative operations and that omitting them does not reduce functionality. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The inclusion of videos:generate is not justified by the current skill description, which focuses on food-note image sequences and captions. While less severe than wallet access, it still grants unnecessary capability and increases the consequences of token theft or misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes uninstall behavior, token revocation, local Beatra state inspection, and deletion of credential/config files despite being described as a food-content tool. Such hidden lifecycle-management capabilities increase the chance of destructive local actions and make the package materially more powerful than users would infer from its label.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes uninstall behavior, token revocation, local Beatra state inspection, and deletion of credential/config files despite being described as a food-content tool. Such hidden lifecycle-management capabilities increase the chance of destructive local actions and make the package materially more powerful than users would infer from its label.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes uninstall behavior, token revocation, local Beatra state inspection, and deletion of credential/config files despite being described as a food-content tool. Such hidden lifecycle-management capabilities increase the chance of destructive local actions and make the package materially more powerful than users would infer from its label.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manifest.json (reported line 80)May include surrounding context.

json

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 14)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 21)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/installation-and-auth.md (reported line 49)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 10)May include surrounding context.

text

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 207)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/authorize.py (reported line 514)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1025)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 40)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.py (reported line 109)May include surrounding context.

python

```

They share the one full-scope Device Token stored in
`~/.beatra/credentials.json`. Installing or switching packages must not trigger
another authorization when that credential is already valid. Do not add,
enable, trust, or configure a host Beatra Connector. Never print or move the
token into command arguments, environment variables, logs, chat, or another

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The authorization flow requests a very broad OAuth scope set, including images, videos, music, speech, voices, artifact/task operations, and wallet spending, while the skill description is limited to food-note/image-post creation and optional Xiaohongshu research. This violates least privilege and means that if the issued token is abused, the skill or any code with access to the shared credential can perform unrelated high-risk actions beyond the user's expected consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inclusion of videos:generate is not justified by the current skill description, which focuses on food-note image sequences and captions. While less severe than wallet access, it still grants unnecessary capability and increases the consequences of token theft or misuse.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The client explicitly supports self-modification via update commands and related update routines, enabling local package files to be replaced from a remote distribution channel. In the context of a food-note skill, self-modifying behavior is unusually powerful and unnecessary, making any compromise of the update ecosystem materially dangerous.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 1503)May include surrounding context.

python

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill declares no explicit tool scope while its documented behavior requires shell, file, network, environment, and write capabilities. That creates an over-privileged execution surface where a nominally content-generation skill can perform sensitive local and remote operations without clear user-visible restriction or least-privilege boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The description centers the skill on Xiaohongshu/REDnote post creation, which implies a specific platform/language/locale context, but the file does not explicitly offer the user a language or locale choice for the generated content. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L011 says the skill will produce title ideas, caption beats, and tags "only from facts the user has supplied." However, L121-L144 explicitly documents reading Xiaohongshu notes, comments, and account activity, and L139-L140 says figures reaching the work may be labeled as looked up rather than user-supplied. That is an active contradiction in the skill's own documentation about what information may be used.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes self-updating installation behavior unrelated to its stated content-creation purpose. Any mechanism that downloads artifacts and replaces local files materially increases supply-chain and persistence risk, especially when embedded in a non-admin, user-facing creative skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatic updates without separate confirmation mean the skill can modify installed files during routine operation, which weakens user control and creates an opportunity for unexpected code changes. Even with integrity checks described, silent replacement is a risky trust and supply-chain pattern for a skill that already has shell, file, and network reach.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest advertises optional reading of Xiaohongshu notes, comments, and account recent notes, but it does not clearly disclose what data is accessed, how it is used, whether it may include personal data, or what consent and retention controls apply. Even if the source content is platform-visible, aggregating and analyzing it can create privacy and compliance risk for users and third parties when transparency is missing.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 9)May include surrounding context.

json

"icon": "https://beatra.ai/textures/icons/zhongcao-food-note-maker-0.1.1.png",
  "localized": {
    "en": {
      "description": "Create a Xiaohongshu food post or REDnote food post from a dish photo, restaurant visit theme, or dining-atmosphere reference. This REDnote food image maker plans restaurant review images and AI food photography as a vertical 3:4 food-note sequence: a cover, dish close-up, table or restaurant atmosphere image, and a final detail image for a food recommendation post. Shape title ideas, caption angles, and tags for a restaurant review post, cafe-hopping post, new-menu launch post, restaurant visit images, food diary images, and restaurant social media images. Optionally it reads Xiaohongshu itself — the notes already running for the topic, one page of a note's top comments, and an account's own recent notes — so Xiaohongshu research, competitor note analysis and comment analysis rest on the platform instead of on guesswork.",
      "display_name": "Zhongcao Food Note Maker",
      "summary": "Turn a dish photo, restaurant visit theme, or dining-atmosphere reference into a coordinated vertical 3:4 REDnote food note with a cover and supporting restaurant-story images.",
      "tags": [

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The English localized description promotes direct Xiaohongshu research, competitor analysis, and comment analysis without warning users that external platform data may be fetched and processed. This can mislead users about the privacy implications of the feature and increase the chance of collecting or analyzing personal data without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.