T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:31- Finding
Excessive Full-Scope Device Authorization
- Content
View full analysis
- Remediation
View remediation
Security audit
zhongcao-local-business-note-maker
Security checks for vulnerabilities and agentic risk
Overview
The skill’s creative workflow is coherent, but it requests and stores a very powerful shared Beatra token, exposes broad remote tool execution, and silently self-updates installed files.
Install only if you trust Beatra and its update channel with a shared full-scope device credential. Before use, understand that the token is stored locally, may authorize spending and unrelated media/tool operations if misused, and the package can silently update itself unless you disable auto updates. Be especially careful on shared Windows profiles and review every paid lookup or generation confirmation before approving.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/mcp_client.py:1463- Finding
Unrestricted MCP Tool Dispatch Bypasses Skill-Level Capability Boundaries
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The command-line client accepts an arbitrary tool name and forwards it directly to the remote `tools/call` method. It does not enforce a package-specific allowlist for the image, model, upload, social, and task operations documented by this Skill. This becomes particularly dangerous when combined with the full-scope bearer token requested by `scripts/authorize.py`. The remote server may perform authorization checks, but those checks operate against the broad token scope rather than the narrower functional scope of this Skill. The JSON requirement on standard input protects arguments from accidental shell exposure, but it does not constrain which remote capability can be invoked. ### Attack Path 1. The Skill obtains the shared full-scope Device Token. 2. An attacker influences an Agent instruction, local invocation, or update ...[truncated 881 chars]- Remediation
View remediation
` dispatch from production Skill packages, or place it behind a separate administrator-only diagnostic utility. 7. Combine the allowlist with a package-specific least-privilege token so client and server independently enforce the same boundary. ]]>
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:969- Finding
Silent Remote Package Replacement Without Independently Anchored Signatures
- Content
View full analysis
bool: """Best-effort silent update. Never block the requested MCP command.""" resolved_state = state_dir or Path.home() / ".beatra" try: resolved_root = (install_root or _current_install_root()).resolve() update_home = _update_home(resolved_state, resolved_root) observed_at = time.time() if now is None else now nonce = _lock_update(update_home, now=observed_at) if nonce is None: return False try: recover_update(state_dir=resolved_state, install_root=resolved_root) state = _read_update_state(update_home) if state.get("auto_update", True) is False: return False last_checked = state.get("last_checked_at") if ( isinstance(last_checked, (int, float)) and observed_at - float(last_checked) < UPDATE_CHECK_MAX_AGE_SECONDS ): return False state["last_checked_at"] = observed_at _write_private_json(update_home / "state.json", state) checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( install_root=resolved_r ...[truncated 2460 chars]- Remediation
View remediation
other
Warning
- Location
scripts/authorize.py:334- Finding
Unnecessary Hostname and Agent-Environment Telemetry
- Content
View full analysis
str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_version": PACKAGE_VERSION, "package_slug": PACKAGE_SLUG, } if device_name: form["device_name"] = device_name status, created = post_form(DEVICE_AUTHORIZATION_URL, form) ``` ### Technical Analysis The authorization helper examines environment-variable signatures to identify the Agent platform an ...[truncated 1641 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:231- Finding
Remote Upload Grant Can Direct User Files to Any HTTPS Host
- Content
View full analysis
dict[str, str]: structured = result.get("structuredContent") instruction = structured.get("upload") if isinstance(structured, dict) else None if not isinstance(instruction, dict) or instruction.get("method") != "PUT": raise RuntimeError("Beatra upload instructions are invalid") url = instruction.get("url") headers = instruction.get("headers") if not isinstance(url, str) or not isinstance(headers, dict): raise RuntimeError("Beatra upload instructions are invalid") parsed = urllib.parse.urlsplit(url) if ( parsed.scheme != "https" or not parsed.hostname or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise RuntimeError("Beatra upload instructions are invalid") if not all(isinstance(key, str) and isinstance(value, str) for key, value in headers.items()): raise RuntimeError("Beatra upload instructions are invalid") content_type = _header_value(headers, "Content-Type") content_length = _header_value(headers, "Content-Length") if content_type != mime_type or content_length != str(len(content)): raise RuntimeError("Beatra upload instructions are invalid") response = put_bytes(url, dict(headers), content) artifact_id = response.get("artifact_id") if not isinstance(artifact_id, str) or not artifact_id: raise RuntimeError("Beatra upload returned an invalid response") return {"type": "artifact", "artifact_id": artifact_id} ``` ### Technical Analysis The client requests an upload grant from the MCP service and then uploads the complete user-selected file to th ...[truncated 1435 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:1044- Finding
Windows Credential Confidentiality Requirement Is Not Enforced
- Content
View full analysis
str: if os.name == "nt": # The state directory lives under the user profile, whose default # ACL is already private to the user (the gh/aws/gcloud posture). # The former custom DACL verification was dropped deliberately: its # command patterns read as hostile to agent safety policies and # endpoint security, failing installs while adding nothing an # elevated administrator could not bypass. return path.read_text(encoding="utf-8") ``` ```python def _private_directory(path: Path) -> None: # POSIX gets explicit 700/600. On Windows the state directory lives under # the user profile, whose default ACL is already private to the user — # the same posture as gh/aws/gcloud credential stores. The former custom # DACL ceremony was dropped deliberately: its command patterns read as # hostile to agent safety policies and endpoint security, failing installs # while adding no protection an elevated administrator could not bypass. path.mkdir(mode=0o700, parents=True, exist_ok=True) if os.name == "posix": path.chmod(0o700) def _restrict_file(path: Path) -> None: if os.name == "posix": path.chmod(0o600) ``` ### Technical Analysis On POSIX systems, the client validates ownership and exact `0700`/`0600` permissions before reading credentials. On Windows, it neither creates an owner-only discretionary access control list nor verifies the inherited ACL before reading the bearer token. The documentation states that the current user must be the only principal granted access, but the implementation relies solely on the user profile’s presumed default ACL. In managed, migrat ...[truncated 1232 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented uninstall/disconnect behaviors involve inspecting local Beatra state, revoking tokens over the network, and deleting local credential and installation files, but these administrative functions are not reflected in the declared purpose. Undisclosed destructive or credential-affecting operations are risky because users may trigger account/state changes without informed consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented uninstall/disconnect behaviors involve inspecting local Beatra state, revoking tokens over the network, and deleting local credential and installation files, but these administrative functions are not reflected in the declared purpose. Undisclosed destructive or credential-affecting operations are risky because users may trigger account/state changes without informed consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented uninstall/disconnect behaviors involve inspecting local Beatra state, revoking tokens over the network, and deleting local credential and installation files, but these administrative functions are not reflected in the declared purpose. Undisclosed destructive or credential-affecting operations are risky because users may trigger account/state changes without informed consent.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use only this package's bundled `scripts/mcp_client.py` for remote operations.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use only this package's bundled `scripts/mcp_client.py` for remote operations.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use only this package's bundled `scripts/mcp_client.py` for remote operations.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use only this package's bundled `scripts/mcp_client.py` for remote operations.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The requested OAuth scope is far broader than the skill's declared purpose, including wallet spending, voice write, music/video generation, tasks control, and broad artifacts access. Overbroad authorization violates least privilege; if the credential is abused or the backend is compromised, the token could be used for unrelated sensitive actions under the user's account.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
This code writes a long-lived bearer access token to a local credentials.json file. While local token storage is common, in this skill it is coupled with an over-privileged scope set, so compromise of the file would grant broad account capabilities well beyond note generation; the danger is amplified by the token's sensitive power rather than by the file write alone.
- Content
python scope = _required_string(polled, "scope") if set(scope.split()) != set(SCOPE.split()): raise RuntimeError("Beatra authorization returned an unsupported scope") credential_path = state_dir / "credentials.json" _atomic_json( credential_path, {
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The client contains a full self-update mechanism that downloads remote discovery metadata, manifests, and archives, then replaces files under the local installation root. For a skill whose stated purpose is generating local-business posts, self-modifying package logic substantially expands the trust boundary and creates a supply-chain/persistence path if the update channel, publisher account, or signing assumptions are compromised.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI exposes a generic tool invocation path that reads arbitrary JSON from stdin and forwards it as a tools/call request to the remote MCP service. This exceeds the declared narrow skill purpose and can turn the package into a general remote action proxy, increasing the chance of misuse, unauthorized capability exposure, or policy bypass if broader tools are reachable through the same credential.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The explicit self-update command exposes intentional self-modification of the installed package, including downloading and replacing local files. In the context of a content-generation skill, this is unnecessary and dangerous because it enables persistence and post-install behavior changes through a remote-controlled update path rather than through the host platform's normal package management.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares no explicit tool scope or allowed-tools restrictions even though its instructions clearly rely on shell, file, network, and environment capabilities. That increases the blast radius of prompt injection, tool misuse, and accidental execution because the runtime permissions are broader and less transparent than users would expect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill includes silent automatic update and package replacement capability unrelated to its core note-making function. Even with integrity checks, self-updating code changes the trusted execution surface after installation and creates a supply-chain risk if the update channel, signing assumptions, or packaged client are ever compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Automatic updates are enabled silently and are not clearly disclosed in the main description, so users may not realize code can change without separate approval. This weakens informed consent and makes downstream supply-chain or behavior changes more dangerous because the trust boundary shifts after installation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest explicitly advertises reading Xiaohongshu notes, top comments, and account posts, but it does not disclose what data is accessed, how consent is obtained, how long data is retained, or whether third-party content is stored or reused. In a skill that performs external platform research, this omission can mislead users about privacy exposure and cause unauthorized or non-compliant handling of scraped or account-linked content.
- Content
Static analysis
No suspicious patterns detected.