WaveSpeedAI Nano Banana 2 Image Generation/Editing

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:07 AM UTC
• Version: 2.0.1

Overview

This skill is a coherent WaveSpeed AI image-generation helper, with normal third-party CLI, credential, and upload risks disclosed enough to guide users rather than block it.

Install only if you are comfortable using WaveSpeed AI as a third-party cloud service. Avoid uploading sensitive, regulated, or proprietary images unless approved, and prefer pinned package versions or a restricted environment for the CLI/MCP setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned Global Installation of a Third-Party CLI Package## Vulnerability Details **File Location**: `SKILL.md`, line 18 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @wavespeed/cli wavespeed login # opens https://wavespeed.ai/accesskey and stores the key wavespeed status # confirms you are signed in ``` ### Technical Analysis The Skill instructs users to globally install `@wavespeed/cli` without specifying an exact reviewed version or verifying package integrity. Consequently, npm resolves whichever release is current at installation time. The installed code can therefore differ from the version assessed when the Skill was published. npm packages can run lifecycle scripts during installation. Such scripts execute with the permissions of the invoking user and may access the filesystem, environment variables, network, and user configuration. A compromised package release, transitive dependency, maintainer account, or package-registry response could therefore introduce arbitrary local code execution. Global installation increases the exposure because the package is placed into a shared executable location and may subsequently be invoked from unrelated working directories. The accompanying authentication workflow also creates a locally stored WaveSpeed credential that compromised package code could attempt to access. ### Attack Path 1. An attacker compromises the `@wavespeed/cli` package, one of its transitive dependencies, its publisher account, or the relevant package-distribution channel. 2. The attacker publishes a malicious release or modifies an installation dependency. 3. A user follows the Skill and runs `npm install -g @wavespeed/cli`. 4. npm resolves the unpinned malicious release and executes any applicable installation lifecycle scripts. 5. The malicious code executes with the invoking user's privileges and may inspect local files, environment variables, npm c ...[truncated 776 chars]
• Remediation: ## Remediation Suggestions - Pin `@wavespeed/cli` to an exact version that has undergone security review. - Prefer a project-local installation governed by a committed lockfile instead of a global installation. - Use deterministic installation mechanisms such as `npm ci` with a reviewed lockfile. - Verify package provenance, publisher identity, registry source, and integrity metadata before installation. - Review the package and its transitive dependencies for unexpected lifecycle scripts. - Where operationally feasible, disable installation scripts and explicitly enable only those proven necessary. - Run the CLI as a non-privileged user in a restricted environment with access only to files required for the requested image task. - Document how and where credentials are stored, apply restrictive filesystem permissions, and support credential revocation and rotation after suspected package compromise.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25
• Finding: Automatic Download and Execution of an Unpinned MCP Package## Vulnerability Details **File Location**: `SKILL.md`, line 25 **Vulnerability Type**: Automatic execution of an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```text Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). It shares the CLI's stored login. Every example below maps one-to-one onto `run_model` with the same model id and input fields. ``` ### Technical Analysis The documented command `npx -y @wavespeed/mcp` allows npm to resolve, download, and execute the latest available package without pinning a reviewed version. The `-y` option suppresses the normal installation confirmation, reducing the opportunity for the user to inspect the resolved package and version before execution. Unlike merely declaring a dependency, this command immediately transfers control to remotely distributed package code. That process runs with the invoking user's permissions and may access local files, environment variables, network resources, and user-owned configuration. The documentation further states that the MCP package shares the CLI's stored login, increasing the sensitivity of the execution context. This is classified as an insecure dependency issue because the documented package itself appears to be an intended WaveSpeed component, but its version and integrity are not constrained. The audit found no evidence that the currently referenced package is malicious. ### Attack Path 1. An attacker compromises the `@wavespeed/mcp` publisher account, package release process, transitive dependency, or package-distribution channel. 2. A malicious package version is made available under the expected package name. 3. A user or agent follows the Skill and runs `npx -y @wavespeed/mcp`. 4. `npx` automatically ac ...[truncated 1120 chars]
• Remediation: ## Remediation Suggestions - Pin `@wavespeed/mcp` to an exact, reviewed version rather than resolving the latest release. - Remove `-y` so package acquisition is not accepted automatically. - Prefer installing the MCP server as a project-local dependency under a committed lockfile and invoke the reviewed local binary. - Configure npm to use an explicitly trusted registry and verify package provenance and integrity metadata. - Audit package lifecycle scripts, entry points, and transitive dependencies before approving a version. - Execute the MCP server in a sandbox or container with restricted filesystem access, a minimal environment, and controlled outbound networking. - Expose only the credentials and input files required for the current operation; do not provide broad access to the user's home directory. - Separate MCP credentials from unrelated CLI credentials where supported, and use short-lived, narrowly scoped tokens. - Maintain a documented process for revoking credentials and removing cached package artifacts if a dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

```bash
npm install -g @wavespeed/cli

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill recommends executing `npx -y @wavespeed/mcp` without pinning a specific version, which can fetch and run whatever package version is current at execution time. This creates a supply-chain risk: a compromised upstream package, malicious maintainer update, or dependency hijack could lead to arbitrary code execution in the user's environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to upload local images and send prompts to an external AI service but does not clearly warn that image content and prompts will be transmitted off-host to WaveSpeed AI. This can lead to unintended disclosure of sensitive personal, proprietary, or regulated data, especially in an image-editing workflow where users may assume local processing.

Static analysis

No suspicious patterns detected.