sn-image-base

• Outcome: Review
• Latest audit: Aug 19, 2026 · 3:10 AM UTC
• Version: 2026.8.19

Overview

The skill mostly matches its stated image and text model utility purpose, but it needs Review because it forwards local inputs to configurable providers and disables safety filtering for one image backend.

Install only if the calling skills clearly control which files, prompts, images, endpoints, and API keys are used. Avoid sending sensitive content, do not use --insecure outside controlled debugging, pin and audit dependencies, and review or remove the Nano Banana safetySettings override before enabling that backend.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities to read environment variables, read local files from prompt/image paths, write generated images to disk, and make network calls, yet no permissions are declared. This creates a transparency and policy-enforcement gap: upper layers or operators may invoke the skill without realizing it can access sensitive local data and transmit it externally.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The client explicitly sets multiple `safetySettings` thresholds to `OFF`, disabling provider-side filtering for harassment, hate speech, sexually explicit, and dangerous content. In a base-layer internal skill, this is especially risky because upper-layer skills may rely on backend safeguards; disabling them increases the chance the system can be used to generate harmful or policy-violating imagery without compensating controls visible in this file.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states it calls backend image, VLM, and LLM services and accepts prompts, images, and text, but it does not clearly warn that these inputs may be transmitted to external providers. Because the skill can also read data from local file paths and environment-backed configuration, missing disclosure increases the risk of unintentional exfiltration of sensitive content to third-party endpoints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The spec exposes an `--insecure` flag that disables TLS verification but does not pair it with a strong warning about man-in-the-middle risk, certificate spoofing, or the need to restrict use to controlled debugging scenarios. Because this skill is a low-level backend-facing component and accepts API keys and prompts, turning off certificate validation could expose credentials and traffic contents to interception.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The image recognition path sends user prompts and image inputs to remote model endpoints selected via CLI or environment configuration, but the runner provides no explicit disclosure or consent boundary at execution time. In this skill context, which is a low-level backend utility intended for upper-layer skills, that increases the chance that sensitive images or prompts are forwarded externally without the caller surfacing that fact to end users.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The text optimization path transmits user and system prompts to an external LLM service without any in-band warning, consent check, or sensitivity guard. Because this is a non-user-facing base skill, upstream developers may unknowingly pass secrets, proprietary text, or regulated data through it, making the missing disclosure more dangerous in practice.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: get_env_var_help() returns the current value of any requested field verbatim, including fields marked secret such as API keys. In this skill, configuration is largely environment-derived and intended for backend service authentication, so any caller that can trigger this helper could exfiltrate credentials through logs, UI output, or agent responses.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code includes raw `response_content` in exception messages for 401/403, 429/503, 5xx, and other 4xx responses. Backend error bodies often contain sensitive data such as tokens, internal identifiers, stack traces, prompts, or request metadata, and embedding them into exceptions can leak that data into logs, telemetry, or upper-layer user-visible error messages. In this skill’s context, the helper is a shared low-level HTTP client for image/VLM/LLM backends, which increases exposure because many callers may propagate these exceptions broadly.

External Transmission

Medium

• Category: Data Exfiltration

Content

| Type | `--llm-type` / `--vlm-type` | Recommended base-url | Code Appended Path | Final URL Example |
|------|------------------------------|---------------|--------------|---------------|
| LLM | `openai-completions` | `https://token.sensenova.cn/v1` | `/chat/completions` | `https://token.sensenova.cn/v1/chat/completions` |
| LLM | `anthropic-messages` | `https://api.anthropic.com/v1` | `/messages` | `https://api.anthropic.com/v1/messages` |
| VLM | `openai-completions` | `https://token.sensenova.cn/v1` | `/chat/completions` | `https://token.sensenova.cn/v1/chat/completions` |
| VLM | `anthropic-messages` | `https://api.anthropic.com/v1` | `/messages` | `https://api.anthropic.com/v1/messages` |

• Confidence: 85% confidence
• Finding: The skill supports sending user prompts and images to externally configured endpoints, including third-party providers such as Anthropic. External transmission is expected for this type of integration, but it remains security-relevant because sensitive local inputs may be sent off-system, especially given this base-layer skill performs no preprocessing or redaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

| Type | `--llm-type` / `--vlm-type` | Recommended base-url | Code Appended Path | Final URL Example |
|------|------------------------------|---------------|--------------|---------------|
| LLM | `openai-completions` | `https://token.sensenova.cn/v1` | `/chat/completions` | `https://token.sensenova.cn/v1/chat/completions` |
| LLM | `anthropic-messages` | `https://api.anthropic.com/v1` | `/messages` | `https://api.anthropic.com/v1/messages` |
| VLM | `openai-completions` | `https://token.sensenova.cn/v1` | `/chat/completions` | `https://token.sensenova.cn/v1/chat/completions` |
| VLM | `anthropic-messages` | `https://api.anthropic.com/v1` | `/messages` | `https://api.anthropic.com/v1/messages` |

• Confidence: 85% confidence
• Finding: The skill supports sending user prompts and images to externally configured endpoints, including third-party providers such as Anthropic. External transmission is expected for this type of integration, but it remains security-relevant because sensitive local inputs may be sent off-system, especially given this base-layer skill performs no preprocessing or redaction.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.25.0
pillow>=11.3.0
python-dotenv>=1.0.0

• Confidence: 90% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.25.0`), which permits future versions to be installed without review. This creates supply-chain and stability risk because a later release could introduce breaking changes or newly disclosed vulnerabilities into the skill implicitly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.25.0
pillow>=11.3.0
python-dotenv>=1.0.0

• Confidence: 98% confidence
• Finding: `pillow>=11.3.0` is unpinned and also allows installation of the specifically flagged vulnerable version 11.3.0. In an image-processing base skill, this is more dangerous than usual because Pillow is directly relevant to the skill's core functionality and may process attacker-controlled image content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.25.0
pillow>=11.3.0
python-dotenv>=1.0.0

• Confidence: 94% confidence
• Finding: `python-dotenv>=1.0.0` is unpinned, so dependency resolution may select future unreviewed versions or the known vulnerable 1.0.0 release. Even though this skill is not user-facing, environment/config handling in backend skills can still affect deployment integrity and local file safety.

Known Vulnerable Dependency: pillow==11.3.0 — 10 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The requirement `pillow>=11.3.0` permits installation of Pillow 11.3.0, and the finding identifies multiple advisories affecting that version. Because this skill provides low-level image APIs, vulnerable image parsing or related Pillow functionality can be exposed through normal skill operation, increasing the chance of denial of service, unsafe file handling, or command-execution-style impacts depending on the reachable code paths.

Known Vulnerable Dependency: python-dotenv==1.0.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The requirement `python-dotenv>=1.0.0` allows the vulnerable 1.0.0 release, which is flagged for symlink-following and arbitrary file overwrite issues in `set_key`. While this package may only be used for configuration, backend/internal skills often run with filesystem access, so misuse or accidental invocation could affect sensitive local files or deployment configuration.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

base_url=base_url,
            model=global_configs.SN_IMAGE_GEN_MODEL,
            timeout=args.timeout,
            ssl_verify=not args.insecure,
        )
        print(
            f"Using SenseNova model {global_configs.SN_IMAGE_GEN_MODEL!r} for image generation",

• Confidence: 93% confidence
• Finding: The --insecure option allows TLS verification to be disabled for image-generation requests, enabling man-in-the-middle interception or tampering of API traffic, including prompts, API keys, and generated content. Since this skill directly handles credentials and connects to configurable remote endpoints, weakening transport security materially increases the risk of credential theft and response manipulation.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

base_url=base_url,
            model=global_configs.SN_IMAGE_GEN_MODEL,
            timeout=args.timeout,
            ssl_verify=not args.insecure,
        )
        print(
            f"Using Nano Banana model {global_configs.SN_IMAGE_GEN_MODEL!r} for image generation",

• Confidence: 93% confidence
• Finding: This code path similarly permits SSL verification to be turned off for the Nano Banana backend, exposing API keys and request/response contents to interception and tampering. In a base-layer skill that may be reused broadly, such an option can propagate insecure deployment habits across higher-level tools.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README_CN.md:44

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:44