nano-banana2

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.0.4

Overview

This image-generation skill is coherent, but it needs review because it can persist and automatically read a saved API key while sending prompts and image URLs to a third-party service.

Install only if you are comfortable sending prompts, reference-image URLs, and an API key to agent.mathmind.cn. Prefer a session environment variable over saving the key locally, avoid the documented echo pipeline for real keys, and do not allow the skill to read ~/.config/nano-banana2/.env unless you explicitly choose local-key mode.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.sh:92
• Finding: API Key and Request Data May Be Forwarded Through HTTP Redirects<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.sh:92-95` **Vulnerability Type**: Sensitive credential disclosure through server-controlled redirects **Risk Level**: Medium ### Vulnerable Code ```bash response=$(curl -s -m "$TIMEOUT" --location "$API_URL" \ --header 'Content-Type: application/json' \ --header "x-api-key: $X_API_KEY" \ --data "$payload" 2>&1) ``` ### Technical Analysis The script uses curl's `--location` option, allowing the remote API server to control redirect destinations. The request contains a custom `x-api-key` header and a JSON body containing the user's prompt and reference-image URLs. Custom headers specified with `--header` can remain associated with redirected requests. Consequently, a compromised, malicious, or misconfigured API endpoint could issue a redirect to an attacker-controlled host and cause sensitive request information to be transmitted outside the declared endpoint. Following redirects is not necessary for the Skill's core image-generation functionality when the API has a fixed, documented endpoint. ### Attack Path 1. The user invokes `scripts/generate.sh` with a valid API key and image-generation parameters. 2. The script sends the request to the declared API endpoint. 3. The endpoint, or infrastructure controlling it, returns an HTTP redirect to an attacker-controlled host. 4. Curl follows the redirect because `--location` is enabled. 5. The redirected request may expose the custom API-key header, prompt, reference-image URLs, or other request data to the attacker-controlled destination. ### Impact Assessment Successful exploitation could disclose: - The user's `X_API_KEY`, potentially allowing unauthorized API use and consumption of paid credits. - User prompts, which may contain confidential or proprietary information. - Reference-image URLs, including potentially sensitive or access-bearing URLs. The issue does not grant local system privileges or arbitrary code execution. I ...[truncated 96 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `--location` because the API endpoint is fixed and redirects are not required: ```bash response=$(curl -sS -m "$TIMEOUT" "$API_URL" \ --header 'Content-Type: application/json' \ --header "x-api-key: $X_API_KEY" \ --data "$payload" 2>&1) ``` - Treat any 3xx response as an error and report it without following the destination. - If redirects are operationally unavoidable, resolve and validate each redirect target against an exact HTTPS origin allowlist before sending credentials. - Never forward `x-api-key` to a different scheme, hostname, or port. - Consider using `--proto '=https'` to prevent protocol downgrade. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:243
• Finding: Interaction Instructions Contradict Explicit Consent for Local Credential Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:243-250` **Vulnerability Type**: Unauthorized local credential-file access caused by conflicting instructions **Risk Level**: Medium ### Vulnerable Code ```markdown ## 交互模板（对话时） 1. 尝试自动读取 key（`X_API_KEY` 或 `~/.config/nano-banana2/.env`） 2. 若缺 key，提示用户提供 `x-api-key`（`kexiangai.com`） 3. 收集 `prompt`（必填） 4. 询问 `urls`（可选） 5. 询问 `aspectRatio`（默认 `auto`） 6. 询问 `imageSize`（默认 `1K`） 7. 执行调用并给出结构化结果 ``` ### Technical Analysis The interaction template instructs the Agent to automatically read either `X_API_KEY` or `~/.config/nano-banana2/.env`. This conflicts with the earlier security declaration that the local credential file must only be accessed after the user explicitly enables `--use-local-key`. The shell implementation enforces the safer opt-in behavior, but an Agent following the natural-language interaction template could bypass that boundary and inspect a persisted secret without explicit authorization. Reading an environment variable supplied to the process is expected; automatically opening a persistent credential file is a separate privilege and requires clear consent under the Skill's declared policy. ### Attack Path 1. The Skill is loaded and the Agent follows the interaction template. 2. `X_API_KEY` is absent from the current environment. 3. The user has not selected `--use-local-key` or otherwise consented to local-file access. 4. The Agent follows step 1 and reads `~/.config/nano-banana2/.env`. 5. The credential is then available to the Agent and may be used in an external API request without the promised explicit approval. ### Impact Assessment The issue allows access to a locally persisted API credential beyond the Skill's stated default privilege boundary. The directly affected scope is the nano-banana2 credential file under the current user's home directory. No evidence shows access to unrelated credentials, SSH keys, privileged system files, or root-level resources. Neverthel ...[truncated 128 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make the interaction template consistent with the declared opt-in policy: ```markdown 1. Read `X_API_KEY` from the current environment if present. 2. If it is absent, ask the user whether to provide a key for this session or explicitly enable `--use-local-key`. 3. Read `~/.config/nano-banana2/.env` only after explicit user approval. ``` - Do not instruct an Agent to inspect the local file automatically. - Record consent in the current interaction before invoking the local-key mode. - Preserve the script's existing precedence rule: environment variable first, local file only with `--use-local-key`. - Clearly state the exact file path and purpose when requesting approval. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:203
• Finding: Documented Standard-Input Command Can Expose the API Key in Shell History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:203-210` **Vulnerability Type**: Plaintext credential exposure through command history **Risk Level**: Low ### Vulnerable Code ```bash # 1) 首次配置 key（只需一次） mkdir -p ~/.config/nano-banana2 # 推荐：交互输入（不会出现在 shell 历史与进程参数） ./scripts/set_key.sh # 或：从标准输入读取 echo '你的x-api-key' | ./scripts/set_key.sh --stdin ``` ### Technical Analysis Although the key is passed to `set_key.sh` through standard input, the literal secret is embedded in the shell command itself. Interactive shells commonly save commands in history files. Replacing the placeholder with a real credential may therefore persist the API key in plaintext shell history. The interactive mode of `set_key.sh` already reads the key with terminal echo disabled and is safer than the documented `echo` pipeline. The stored `.env` file is assigned mode `600`, so the primary issue is the command example rather than the destination file's final permissions. ### Attack Path 1. A user copies the documented pipeline and replaces the placeholder with a valid API key. 2. The shell records the complete `echo 'key' | ...` command in its history. 3. Another local account, process, diagnostic collector, backup system, or support bundle gains access to that history. 4. The exposed key is recovered and used to make unauthorized API requests. ### Impact Assessment Exploitation could disclose the user's API key and permit unauthorized use of the corresponding external service, including consumption of paid credits or rate limits. This issue does not provide code execution or elevated operating-system privileges. Exploitation requires access to shell history or a copy of it, so the risk is lower than direct network disclosure. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove examples that place a literal API key in a command. - Recommend only the existing interactive mode: ```bash ./scripts/set_key.sh ``` - If non-interactive operation is required, read from an already protected secret source rather than a command-line literal: ```bash ./scripts/set_key.sh --stdin < /path/to/protected/key-file ``` - Ensure the source file is owner-readable only and delete it securely when it is no longer required. - Warn users to rotate any key that may already have been entered through the documented `echo` command and remove affected shell-history entries and backups where feasible. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is image generation, but the skill also instructs persistence and ingestion of API credentials from stdin/TTY and local files. That mismatch is security-relevant because it expands behavior into secret handling and local state management that users may not expect from the description, increasing the chance of accidental credential exposure or unsafe invocation.

Credential Access

High

• Category: Privilege Escalation

Content

secrets:
    primary: "X_API_KEY"
  storage:
    optional: ["~/.config/nano-banana2/.env (only when user explicitly enables --use-local-key)"]
---

## 安全声明（ClawHub 扫描友好）

• Confidence: 96% confidence
• Finding: The skill explicitly supports storing the API key in a local .env file. Plaintext credential storage in a predictable path creates a real credential access risk from other local processes, accidental backups, sync tools, or later compromise of the agent workspace.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
mkdir -p ~/.config/nano-banana2
cat > ~/.config/nano-banana2/.env << 'EOF'
X_API_KEY=你的x-api-key
EOF
chmod 600 ~/.config/nano-banana2/.env

• Confidence: 97% confidence
• Finding: The setup instructions tell users to write X_API_KEY directly into ~/.config/nano-banana2/.env. That creates a durable plaintext secret on disk, which meaningfully increases the chance of unauthorized credential recovery compared with session-only secret injection.

Credential Access

High

• Category: Privilege Escalation

Content

cat > ~/.config/nano-banana2/.env << 'EOF'
X_API_KEY=你的x-api-key
EOF
chmod 600 ~/.config/nano-banana2/.env
```

### 后续自动加载

• Confidence: 96% confidence
• Finding: The same .env persistence pattern is reinforced by permission-setting instructions, normalizing long-lived local storage of the API key. Restrictive permissions help, but they do not remove the underlying risk of plaintext credential retention and later access by malware, backups, or operator error.

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

exit 1
fi

if [[ -z "${X_API_KEY:-}" && "$use_local_key" == "true" && -f "$HOME/.config/nano-banana2/.env" ]]; then
  require_cmd "grep"
  require_cmd "tail"
  require_cmd "cut"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

exit 1
fi

if [[ -z "${X_API_KEY:-}" && "$use_local_key" == "true" && -f "$HOME/.config/nano-banana2/.env" ]]; then
  require_cmd "grep"
  require_cmd "tail"
  require_cmd "cut"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

exit 1
fi

if [[ -z "${X_API_KEY:-}" && "$use_local_key" == "true" && -f "$HOME/.config/nano-banana2/.env" ]]; then
  require_cmd "grep"
  require_cmd "tail"
  require_cmd "cut"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

require_cmd "tail"
  require_cmd "cut"
  require_cmd "tr"
  # Safely read key-value from .env without executing file content.
  X_API_KEY=$(grep -E '^X_API_KEY=' "$HOME/.config/nano-banana2/.env" | tail -n 1 | cut -d'=' -f2- | tr -d '\r')
fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

payload=$(python3 -c "import json,sys; print(json.dumps({'urls': json.loads(sys.argv[1]), 'prompt': sys.argv[2], 'aspectRatio': sys.argv[3], 'imageSize': sys.argv[4]}, ensure_ascii=False))" "$urls_json" "$prompt" "$ratio" "$size")

# 带超时调用，只执行一次
response=$(curl -s -m "$TIMEOUT" --location "$API_URL" \
  --header 'Content-Type: application/json' \
  --header "x-api-key: $X_API_KEY" \
  --data "$payload" 2>&1)

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Credential Access

High

• Category: Privilege Escalation

Content

fi

CONF_DIR="$HOME/.config/nano-banana2"
CONF_FILE="$CONF_DIR/.env"

mkdir -p "$CONF_DIR"
cat > "$CONF_FILE" <<EOF

• Confidence: 80% confidence
• Finding: The script persists a sensitive API key in plaintext at `$HOME/.config/nano-banana2/.env`. Even though permissions are tightened afterward, local compromise, overly permissive backups/sync tools, accidental disclosure, or reading by other processes running as the same user could expose the credential and allow unauthorized use of the external image-generation API.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares shell-capable behavior but does not define any explicit tool scope such as allowed-tools or permissions. That increases the blast radius if the skill is invoked in a broader agent environment, because shell access plus file and network operations could be used beyond the narrowly intended image-generation workflow.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The manifest description is written entirely in Chinese and defines usage behavior in that language without indicating language choice or user opt-in. This can violate language/locale policy where skills should not implicitly force a specific language unless the constraint is documented and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

- **单轮对话只允许调用 imgEditNB2 一次，绝不多次调用**
- **绝对禁止：不要因为结果慢就杀死进程重新发起请求**
- **这个 API 生成时间较长（可能需要5-10分钟），请耐心等待结果返回，不要中断或重试**
- 设置超时：curl 命令必须带 `-m 600`（10分钟超时），超时后报告失败，不要重试
- 禁止自动循环重试；任何重试都必须先向用户说明成本风险并获得明确同意。
- 同一组参数在同一轮对话中不得重复提交。

• Confidence: 93% confidence
• Finding: The skill is explicitly designed to transmit user prompts, optional image URLs, and an API key to an external third-party endpoint. This is expected functionality, but it is still a real data egress boundary and can expose sensitive prompts, user-provided URLs, or billing-bearing credentials if invoked without clear consent and minimization.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough to match common requests like '帮我生成一张图', which can cause the skill to activate unexpectedly. In a skill that performs network calls and may consume paid API credits, unintended invocation creates both privacy and cost risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 首次配置（只需一次）

```bash
mkdir -p ~/.config/nano-banana2
cat > ~/.config/nano-banana2/.env << 'EOF'
X_API_KEY=你的x-api-key
EOF

• Confidence: 93% confidence
• Finding: This finding reflects the same persistence behavior in duplicated analyzer output: durable local storage of API credentials in user configuration files. In the context of a networked skill with shell capability, persistence materially increases post-session exposure and recovery risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 首次配置(只需一次)

```bash
mkdir -p ~/.config/nano-banana2
cat > ~/.config/nano-banana2/.env << 'EOF'
X_API_KEY=你的x-api-key
EOF

• Confidence: 93% confidence
• Finding: This finding reflects the same persistence behavior in duplicated analyzer output: durable local storage of API credentials in user configuration files. In the context of a networked skill with shell capability, persistence materially increases post-session exposure and recovery risk.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cat > ~/.config/nano-banana2/.env << 'EOF'
X_API_KEY=你的x-api-key
EOF
chmod 600 ~/.config/nano-banana2/.env
```

### 后续自动加载

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

export X_API_KEY='你的x-api-key'

# 3) 仅提示词生成
curl --location 'https://agent.mathmind.cn/minimalist/api/imgEditNB2' \
--header 'Content-Type: application/json' \
--header "x-api-key: $X_API_KEY" \
--data '{"urls":[],"prompt":"一只猫咪在玩耍","aspectRatio":"auto","imageSize":"1K"}'

• Confidence: 94% confidence
• Finding: The command template demonstrates direct transmission of prompts and the x-api-key to an external endpoint via curl. Even though this is core functionality, embedding raw command patterns for secret-bearing requests increases the chance of leakage through shell history, process inspection, copied logs, or user misuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs callers to send prompts and optional image URLs to a third-party endpoint but does not warn that this data leaves the local system and is transmitted to an external service. In an agent skill, users may provide sensitive prompts or private image URLs, so lack of disclosure increases the risk of unintended data exposure and privacy violations.

External Transmission

Medium

• Category: Data Exfiltration

Content

- 2K
- 4K

## cURL Example

```bash
curl --location 'https://agent.mathmind.cn/minimalist/api/imgEditNB2' \

• Confidence: 93% confidence
• Finding: The cURL example demonstrates sending user-controlled prompt data and optional image references to an external host, confirming external transmission behavior. In this skill's context, that becomes security-relevant because the documentation does not pair the example with consent, minimization, or sensitivity warnings, so implementers may forward private user content without adequate notice.

External Transmission

Medium

• Category: Data Exfiltration

Content

payload=$(python3 -c "import json,sys; print(json.dumps({'urls': json.loads(sys.argv[1]), 'prompt': sys.argv[2], 'aspectRatio': sys.argv[3], 'imageSize': sys.argv[4]}, ensure_ascii=False))" "$urls_json" "$prompt" "$ratio" "$size")

# 带超时调用，只执行一次
response=$(curl -s -m "$TIMEOUT" --location "$API_URL" \
  --header 'Content-Type: application/json' \
  --header "x-api-key: $X_API_KEY" \
  --data "$payload" 2>&1)

• Confidence: 90% confidence
• Finding: This code performs an outbound network request containing the prompt, URLs, and API key to a remote endpoint. In a skill context, external transmission is security-relevant because prompts or referenced images may contain sensitive business, personal, or internal information, and the destination service gains access to that content.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script transmits user-supplied prompts and optional image URLs to a third-party remote API, but the script itself provides no explicit disclosure, consent prompt, or warning at execution time. This can expose sensitive prompts, internal URLs, or private image references to an external service without the operator fully realizing what data leaves the system.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cat > "$CONF_FILE" <<EOF
X_API_KEY=$KEY
EOF
chmod 600 "$CONF_FILE"

echo "x-api-key saved to $CONF_FILE"

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The only natural-language example prompt is written in Chinese, which can implicitly steer users toward a specific language/locale without any opt-in or explanation. For a general API guide, this can conflict with language-neutral policy expectations unless the regional scope is explicitly documented.

Static analysis

No suspicious patterns detected.