T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:31- Finding
Device Authorization Requests Permissions Beyond the Skill's Functional Requirements
- Content
View full analysis
- Remediation
View remediation
Security audit
zhongcao-note-copywriter
Security checks for vulnerabilities and agentic risk
Overview
The skill's core copywriting purpose is clear, but it bundles broad paid-service authority, arbitrary local file upload, and silent self-updating that users should review before installing.
Install only if you are comfortable granting a shared Beatra credential with broad media, artifact, task, and wallet authority. Consider disabling automatic updates with the documented update command, avoid using the upload subcommand unless you intentionally choose the exact file, and treat paid lookup or cover generation as requiring clear price and action confirmation.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/mcp_client.py:1428- Finding
Bundled Client Can Read and Upload Arbitrary Local Files
- Content
View full analysis
dict[str, str]: if re.fullmatch(r"[a-z0-9][a-z0-9.+-]*/[a-z0-9][a-z0-9.+-]*", mime_type) is None: raise RuntimeError("Local upload MIME type is invalid") filename, content = _read_local_upload(path) resolved_state_dir = state_dir or Path.home() / ".beatra" session = _session_with_registration(state_dir=resolved_state_dir, post_json=post_json) result = session.request( 2, "tools/call", { "name": "beatra.assets.upload", "arguments": { "filename": filename, "mime_type": mime_type, "size_bytes": len(content), }, }, ) if failure := _tool_failure_message(result): raise RuntimeError(f"Beatra rejected the upload grant request: {failure}") return _complete_upload( result, mime_type=mime_type, content=content, put_bytes=put_bytes, ) ``` The command-line interface exposes the local path directly: ```python local_upload = subparsers.add_parser( "upload", help="Upload one local regular file and print its artifact reference", ) local_upload.add_argument("path", type=Path) local_upload.add_argument( "--mime-type", required=True, help="Exact media MIME type, such as image/png, audio/mpeg, or video/mp4", ) ``` The server-provided destination is only required to be HTTPS; it is not restricted to a pin ...[truncated 1973 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/mcp_client.py:969- Finding
Automatic Updates Silently Replace Executable Package Files
- Content
View full analysis
dict[str, Any]: path = update_home / "state.json" try: value = json.loads(path.read_text(encoding="utf-8")) except (OSError, json.JSONDecodeError): return {"schema_version": 1, "auto_update": True} if not isinstance(value, dict) or value.get("schema_version") != 1: return {"schema_version": 1, "auto_update": True} return value ``` The update path downloads package files and replaces files in the installation: ```python checked = check_update(get_bytes=get_bytes) if not checked["update_available"]: return False _ensure_owned_baseline( install_root=resolved_root, update_home=update_home, get_bytes=get_bytes, ) discovery = checked["discovery"] manifest, new_files = download_update(discovery, get_bytes=get_bytes) _apply_update( install_root=resolved_root, update_home=update_home, discovery=discovery, manifest=manifest, new_files=new_files, ) return True ``` The updater runs before ordinary commands: ```python else: maybe_auto_update() ``` ### Technical Analysis The client silently checks for updates and can replace executable Python and instruction files while the user is attempting an unrelated Beatra operation. The updater implements substantial defensive controls: fixed HTTPS discovery and CDN paths, redirect rejection, version checks, archive limits, path validation, per-file hashes, ownership tracking, backups, rollback, and locking. These controls reduce transport, archive-traversal, and accidental-corruption risks. They do not provide independent authenticity if the release ...[truncated 1687 chars]- Remediation
View remediation
other
Warning
- Location
scripts/authorize.py:348- Finding
Authorization and Registration Collect Persistent Host and Agent Telemetry
- Content
View full analysis
str: """The agent environment this process runs inside (docs/device-model.md). Order: explicit agent self-report > environment signatures > unknown. Detection reads the process environment only — nothing else runs, nothing reaches the network. """ if explicit: candidate = explicit.strip().lower().replace(" ", "-") if _PLATFORM_VALUE.fullmatch(candidate): return candidate env = os.environ if env.get("CLAUDECODE") == "1" or "CLAUDE_CODE_ENTRYPOINT" in env: return "claude-code" if any(key.startswith("CODEX_") for key in env): return "codex" ai_agent = env.get("AI_AGENT", "").lower() matched = re.match(r"([a-z0-9-]+)_", ai_agent) if matched and _PLATFORM_VALUE.fullmatch(matched.group(1)): return matched.group(1) return "unknown" ``` It also collects the local hostname: ```python def device_display_name() -> str | None: """A hostname the user will recognise in the console device list.""" try: name = socket.gethostname().strip() except OSError: return None if not name or not name.isprintable(): return None return name[:120] ``` The detected hostname and platform are sent during device authorization: ```python form: dict[str, str] = { "client_id": CLIENT_ID, "resource": MCP_URL, "scope": SCOPE, "platform": host_platform, "client_name": PACKAGE_DISPLAY_NAME, "external_installation_ref": external_reference, "package_ ...[truncated 2420 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (34)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
Requesting
wallet:spendgives the skill authority to spend user funds even though the skill description is about copywriting, cover generation, and Xiaohongshu research. A compromised skill, stolen token, or backend misuse could turn this into direct financial loss, making the mismatch between requested privilege and expected behavior especially dangerous.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill also includes uninstall and cleanup behaviors that inspect and modify local Beatra state, revoke authorization remotely, and remove files unrelated to copy generation. Embedding administrative lifecycle actions inside a content skill makes the package more dangerous because a user or host may grant trust based on the narrow declared purpose while the package can alter local installation state and credentials.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill also includes uninstall and cleanup behaviors that inspect and modify local Beatra state, revoke authorization remotely, and remove files unrelated to copy generation. Embedding administrative lifecycle actions inside a content skill makes the package more dangerous because a user or host may grant trust based on the narrow declared purpose while the package can alter local installation state and credentials.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill also includes uninstall and cleanup behaviors that inspect and modify local Beatra state, revoke authorization remotely, and remove files unrelated to copy generation. Embedding administrative lifecycle actions inside a content skill makes the package more dangerous because a user or host may grant trust based on the narrow declared purpose while the package can alter local installation state and credentials.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` They share the one full-scope Device Token stored in `~/.beatra/credentials.json`. Installing or switching packages must not trigger another authorization when that credential is already valid. Do not add, enable, trust, or configure a host Beatra Connector. Never print or move the token into command arguments, environment variables, logs, chat, or another
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The OAuth scope string requests many powerful capabilities far beyond the stated function of generating Xiaohongshu copy and doing limited platform research, including artifacts, media generation, voice operations, task control, and wallet spending. Overbroad authorization violates least privilege and materially increases blast radius if the token is misused, leaked, or the backend/tooling behaves unexpectedly.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The exposed self-update capability enables the package to modify its own local code and supporting files. Self-modifying behavior is particularly risky in an agent skill because it expands the trust boundary from a static reviewed package to a remotely mutable one, which can undermine review, reproducibility, and operator control even if the current update path uses checksums.
- Content
python ) update = subparsers.add_parser( "update", help="Check, install, or configure Beatra package self-updates", ) update.add_argument( "--check",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The script explicitly targets credentials.json as part of the shared ~/.beatra state it manages. Access to credential-bearing files is sensitive because any code path that can read, use, or delete them can impact authentication for other skills, and this is especially concerning in a skill whose advertised purpose is unrelated to credential management.
- Content
python #: these and then removes the directory only if it is empty — the script #: never recursively deletes a directory it does not fully understand. _STATE_FILES = ( "credentials.json", "installation.json", "host.json", "skills.json",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The _device_token function reads access_token from credentials.json and passes it to revocation logic, meaning the skill code can directly access and use a bearer credential. Direct bearer-token access is high risk because any malicious modification of the package, unexpected execution context, or future code change could exfiltrate or misuse the token beyond simple uninstall behavior.
- Content
python def _device_token(state_dir: Path) -> str | None: path = state_dir / "credentials.json" try: value = json.loads(path.read_text(encoding="utf-8")) except (OSError, ValueError):
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares no explicit tool scope while instructing use of shell, network access, filesystem operations, and environment-dependent behavior through a bundled client. That broad undeclared capability increases the chance of over-privileged execution, hidden side effects, and accidental misuse because reviewers and hosts cannot easily constrain what the skill may access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instructions say to default to five titles and a 250–500 Chinese-character note body unless another language is requested. This imposes a specific language/locale by default rather than offering a user choice or requiring opt-in, which can violate language/locale policy expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill enables silent automatic updates that download and replace package-owned files without separate confirmation, yet this is not prominently disclosed in the top-level description. Even with integrity checks described, silent code replacement in a skill that already has shell/network/file capabilities raises supply-chain and trust risks because behavior can change after installation without meaningful user awareness.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest positions the skill around trilingual SEO and provides localized metadata for English, Japanese, and Chinese, but the skill branding and descriptions center a specific platform/locale context without stating that language choice is user-selectable. Under the policy, locale or language constraints should be offered as a user choice or explicitly justified.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
json "icon": "https://beatra.ai/textures/icons/zhongcao-note-copywriter-0.1.1.png", "localized": { "en": { "description": "Create Xiaohongshu or REDnote copy from a product, experience, topic, or audience brief. This AI Xiaohongshu copywriter produces title options, a structured note body, cover wording, relevant hashtags, and a natural comment starter for product discovery, local experiences, beauty, food, fashion, travel, and knowledge posts. It then renders a matching vertical 3:4 Xiaohongshu cover built around the chosen title, with a headline-safe composition. Optionally it reads Xiaohongshu itself — the notes already running for the topic, one page of a note's top comments, and an account's own recent notes — so Xiaohongshu research, competitor note analysis and comment analysis rest on the platform instead of on guesswork.", "display_name": "Zhongcao Note Copywriter", "summary": "Turn a product, experience, topic, or audience brief into Xiaohongshu title options, a readable note body, cover text, hashtags, and a natural comment starter.", "tags": [
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest advertises reading Xiaohongshu notes, top comments, and recent account posts, but it provides no user-facing disclosure about what data is accessed, how it is used, retained, or shared. Even if the data is platform-visible, combining and processing it for competitor/account analysis can create privacy, consent, and compliance risk for users who invoke the skill without understanding the scope of collection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document explicitly states that the client silently checks for and automatically installs newer releases by default, without separate confirmation. Even though the text describes integrity checks and rollback protections, automatic code replacement without explicit user consent materially changes installed software and expands supply-chain risk if the update source, signing process, or release pipeline is ever compromised.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md the user signs in or creates their account there, and the approval page continues automatically after sign-in; - say once that the connection continues automatically after Allow, then detect completion yourself — never ask the user to confirm in chat that they approved. Approval legitimately takes minutes when sign-in or account creation is
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **The two topic operations are deliberately absent.** `social.xiaohongshu.topic.get` and `social.xiaohongshu.topic.notes.list` both require an opaque `page_id`, and nothing on this whitelist returns one. They are 60-credit calls this Skill could never legitimately make, so they are not on the list. Do not ask the user for a `page_id`; search by keyword instead. ## Turning what the user has into arguments
Static analysis
No suspicious patterns detected.