Nano Banana 2 广告图片

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:10 AM UTC
• Version: 1.0.0

Overview

This is a coherent AI Hive image-generation helper for ad images, with expected API-key storage and selected image uploads plus a few hygiene caveats.

Install only if you are comfortable sending prompts and any selected reference images to AI Hive, and prefer using a pinned dependency or locked environment instead of bare pip3 install requests. Treat the saved API key as sensitive and review generated ad images against platform rules before publishing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:76, scripts/imagegen.py:7, and scripts/imagegen.py:19-22
Vulnerability Type: Supply-chain exposure through an unpinned runtime dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:76:

bash

pip3 install requests

scripts/imagegen.py:7:

python

依赖：requests（pip3 install requests）

scripts/imagegen.py:19-22:

python

try:
    import requests
except ImportError:
    print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The project instructs users to install requests directly from the configured Python package index without specifying an exact reviewed version or verifying an integrity hash. The installed artifact can therefore change over time without any corresponding change to the audited project.

Although requests is a legitimate and widely used package, an unpinned installation does not provide reproducible dependency resolution. The effective code executed by the Skill depends on the package version and package-index configuration present when the command is run. This creates exposure to:

• A future compromise of the package or one of its transitive dependencies.
• A malicious or compromised package-index mirror.
• Unexpected dependency changes that introduce exploitable behavior.
• Environment-specific package substitution caused by a custom package-index configuration.

Attack Path

1. An attacker compromises the configured package source, a dependency release, or a package-index mirror used by the target environment.
2. The victim follows the documented pip3 install requests instruction.
3. Because no version or hash is enforced, pip downloads the package currently selected by the package resolver.
4. Malicious installation hooks or imported package code execute under the privileges of the user running the installation or Skill.

...[truncated 796 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dependency file that pins an explicitly reviewed version:

   text

   requests==2.32.5
   

2. Generate and record cryptographic hashes for the package and all transitive dependencies.

3. Install dependencies with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Use a lock-file workflow such as pip-tools, Poetry, or uv to make dependency resolution reproducible.

5. Configure installation to use a trusted package index and disable unexpected supplemental indexes where practical.

6. Integrate dependency vulnerability and integrity scanning into the release process.

7. Replace all bare pip3 install requests instructions with the locked installation procedure.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/imagegen.py:207

Finding

Image-Only Upload Restriction Can Be Bypassed with a Renamed File

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:207-222
Vulnerability Type: Insufficient file-type validation
Risk Level: Low

Vulnerable Code

python

def guess_mime(file_path):
    """根据扩展名推断 MIME 类型。"""
    ext = Path(file_path).suffix.lower()
    return MIME_MAP.get(ext, "application/octet-stream")


def upload_media(client, file_path):
    """三步上传：upload-token → PUT → complete。返回 mediaId。"""
    path = Path(file_path)
    if not path.is_file():
        raise SystemExit(f"文件不存在：{file_path}")

    filename = path.name
    content_type = guess_mime(str(path))
    if not content_type.startswith("image/"):
        raise SystemExit(f"仅允许上传参考图片：{file_path}")
    size = path.stat().st_size

Technical Analysis

The image-only restriction derives the MIME type exclusively from the filename extension. It does not inspect the file signature, parse the file as an image, or confirm that the declared MIME type matches the actual content.

Any regular file renamed with an accepted suffix such as .png, .jpg, .gif, or .webp passes the check. The resulting upload token is requested using the extension-derived content type, and the full file is then uploaded to the object-storage URL returned by the service.

This is a content-validation bypass rather than automatic file disclosure: an attacker or user must still supply the path through upload --file or generate --image. The code does not independently discover or upload arbitrary files.

Attack Path

1. An attacker prepares arbitrary non-image content.

2. The attacker renames the file with an accepted image extension, for example payload.png.

3. The attacker invokes:

   bash

   python3 scripts/imagegen.py upload --file payload.png
   

   Alternatively, the file can be supplied through generate --image.

4. guess_mime() returns image/png based only on the suffix.

5. The `content_type.starts ...[truncated 921 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate file signatures using a maintained content-detection library rather than trusting the extension.
2. Decode and verify the image before upload. For example, use Pillow's Image.verify() followed by a fresh decode of the file.
3. Derive the MIME type from successfully decoded content and require it to match an explicit allowlist.
4. Reject malformed images and mismatches between the filename extension, detected format, and declared MIME type.
5. Enforce a conservative maximum file size before requesting an upload token.
6. Consider removing complex formats that are not required, particularly formats with broader parser attack surfaces.
7. Re-encode accepted images into a canonical format before upload when preserving the original byte stream is unnecessary.
8. Retain equivalent server-side validation because client-side checks can always be bypassed by direct API access.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes a local Python script that can read/write files, access environment-stored secrets, make network requests, and execute through shell examples, yet the manifest does not declare any explicit tool scope or permission boundaries. This creates an over-privileged and opaque execution model where a reviewer or runtime may not clearly constrain what the skill is allowed to do, increasing the risk of unintended file access, secret exposure, or outbound data transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring and user-facing CLI text are written entirely in Chinese, and the script provides no option to select another language or locale. This is a natural-language policy issue because the skill implicitly enforces a specific language for all prompts, errors, and instructions without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description on L03 presents the skill in Chinese while also embedding English terms, but it does not state that users may choose their preferred language. This can amount to an implicit language policy constraint because the skill appears primarily tailored to Chinese-language interaction without explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example API key value contains Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration guidance. There is no indication that the skill is region-specific or that users may choose their preferred language, so this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.