GPT Image 2 + Nano Banana 中转生图｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

This is a disclosed AI-HIVE media generation helper that uses an API key and user-selected uploads, with some scope and language-documentation caveats.

Before installing, be aware that this skill can submit potentially billable AI-HIVE image or video jobs, upload media files you specify, download generated outputs, and store an API key locally if you run init. Only use authorized source media and confirm parameters before generation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a mismatch because the description is narrowly about a GPT Image 2 + Nano Banana image relay skill for image generation/editing through AI-HIVE, but the code exposes materially broader capabilities not mentioned in the description. In particular, it includes general-purpose AI-HIVE text chat, video generation, account/model inspection, API-key setup, and a separate blueprint generator. While parts of the code do support the declared image relay workflow (reference upload, routing, pricing snapshots, polling, download), the implemented functionality significantly exceeds that stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest and title consistently frame the skill around 'GPT Image 2 + Nano Banana' image relay and image generation workflows. However, the runnable examples explicitly introduce video task submission via `scripts/videogen.py`, `t2v`, `i2v`, and `r2v`, which expands the behavior beyond the stated image-focused scope.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The documentation states that '视频本地处理需要 ffmpeg', implying local video processing capability. For a skill whose stated purpose is relaying GPT Image 2 and Nano Banana image-generation requests, local video processing is not an obvious or declared requirement.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The manifest description repeatedly describes the skill as handling image API relay, image editing/generation needs, reference image upload, and image-model routing. Later documentation contradicts that framing by documenting video generation workflows and video reference handling, creating an intent/documentation divergence within the skill file.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest frames this skill as a narrowly scoped image-generation relay for GPT Image 2 and Nano Banana workflows. However, the codebase includes broad OpenAPI capabilities for text chat, video generation, account/user info retrieval, model enumeration, and general media upload, which materially exceed the described image-relay behavior even if some are not exposed by the final skill_main entrypoint.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module docstring explicitly says it wraps text chat, image generation, video generation, model queries, media upload, and task polling as a universal AI tool. That directly conflicts with the manifest's specialized purpose as a GPT Image 2 + Nano Banana image relay skill, creating intent ambiguity for reviewers and operators.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest positions the skill as a relay for GPT Image 2 and Nano Banana image generation/editing, including image-model selection and image-task handling. In contrast, the generated skill configuration and entrypoint in this file are explicitly for video generation: it advertises a video example, maps t2v/i2v/r2v video models, exposes a `generate` command for videos, accepts video/audio/first-frame/last-frame inputs, and dispatches to `cmd_video`.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest's core feature is choosing between two image-model families from one business entrypoint while preserving routing rationale. However, `SKILL_CONFIG` only contains video model identifiers (`t2v`, `i2v`, `r2v`), `_select_video_mode` chooses among video-generation modes based on media inputs, and `skill_generate` always forwards into `cmd_video`; there is no dual image-model selection logic corresponding to GPT Image 2 and Nano Banana.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The skill content, headings, trigger phrases, examples, and output instructions are written entirely in Chinese and do not indicate that other languages are supported or that the user may choose a preferred language. Under the policy, a skill should not impose a specific language or locale without opt-in or a clearly documented, justified locale restriction.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: This is a manifest file, so vague-trigger checks apply. Setting `allow_implicit_invocation: true` provides no explicit trigger scope, negative examples, or limiting context, which can cause the skill to activate more broadly than intended.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The default prompt explicitly instructs the skill to produce a "production-ready Chinese workflow," which imposes a specific language choice. This is a natural-language locale policy concern because the file does not offer the user a language option or explain why Chinese is required.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The top-level docstring and all user-facing guidance are written only in Chinese, and the file provides no indication that users may select another language or that the skill is intentionally restricted to a Chinese-speaking context. This is a natural-language locale policy concern because the skill effectively imposes a specific language without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains user-facing descriptions and prompts entirely in Chinese, including setup, errors, and command help, with no indication that another language is supported. The policy requires flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _resolve_api_key(self, cli_key):
        if cli_key:
            return cli_key
        env_key = os.environ.get("AI_HIVE_API_KEY")
        if env_key:
            return env_key
        file_config = self._read_config_file()

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _try_read_existing_api_key():
    """安全读取已配置的 API Key，失败返回 None。"""
    env_key = os.environ.get("AI_HIVE_API_KEY")
    if env_key:
        return env_key
    try:

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _resolve_api_key(self, cli_key):
        if cli_key:
            return cli_key
        env_key = os.environ.get("AI_HIVE_API_KEY")
        if env_key:
            return env_key
        file_config = self._read_config_file()

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _try_read_existing_api_key():
    """安全读取已配置的 API Key，失败返回 None。"""
    env_key = os.environ.get("AI_HIVE_API_KEY")
    if env_key:
        return env_key
    try:

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Static analysis

No suspicious patterns detected.