T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:90- Finding
Bearer API Key Can Be Redirected to an Arbitrary Server
- Content
View full analysis
- Remediation
View remediation
Security audit
Nano Banana 2 角色一致性图片
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent AI image-generation wrapper, but it handles an API key in a way that can send it to a user- or environment-configured server.
Review before installing. Use it only if you trust the AI Hive endpoint and keep AI_HIVE_BASE_URL and ~/.ai-hive/config.json under your control. Avoid custom base URLs unless you are certain they are trusted, and consider using a dedicated API key with limited balance or permissions. Install dependencies in a virtual environment rather than a shared Python environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:71- Finding
Unpinned Runtime Dependency Installation
- Content
View full analysis
``` ### Technical Analysis The installation instruction resolves the current version of `requests` and its transitive dependencies at installation time. The project provides no pinned version, lock file, hash verification, or isolated-environment requirement. This makes the installed dependency set mutable and non-reproducible. A future compromised release, compromised package index, malicious configured mirror, or incompatible transitive dependency could introduce attacker-controlled code or unsafe behavior. Using bare `pip3` may also install into a shared interpreter environment, increasing the effect on other Python applications. The package name is legitimate and there is no evidence that the currently published package is malicious. The confirmed weakness is the absence of dependency integrity and reproducibility controls. ### Attack Path 1. A user follows the documented `pip3 install requests` instruction. 2. `pip` contacts its configured package index or mirror and resolves the latest eligible package and transitive dependencies. 3. No project-controlled version or hash is checked. 4. If the selected release or configured source is compromised, malicious package code can execute during installation or when `requests` is imported. 5. Execution occurs with the privileges of the user running `pip3` or the Skill. ### Impact Assessment The potential privilege level is that of the user performing the installation. In a user-scoped environment, malicious dependency code could access that user's files, credentials, network resources, and process environment. If installation ...[truncated 261 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes Python scripts that can use shell, filesystem, environment, and network capabilities, but the manifest does not declare any tool scope or permission boundaries. This creates a least-privilege violation: an agent or reviewer cannot easily determine or constrain what the skill is allowed to access, increasing the risk of unintended file access, command execution, or outbound requests if the backing script is modified or abused.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module is fundamentally a general-purpose AI Hive client supporting chat, image, video, model enumeration, uploads, and polling, while being packaged as a single-purpose character-consistency skill. This mismatch is dangerous because agents or reviewers may trust the declared scope and grant permissions accordingly, even though the code can perform substantially broader actions than advertised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code presents the skill's primary description entirely in Chinese, and the rest of the CLI help and prompts are also Chinese-only. That forces a specific language/locale on all users without opt-in, which matches the natural-language policy violation criteria.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Including user account information retrieval in a character-consistency image skill violates least functionality and may expose wallet balance or account metadata unrelated to the task. In an agent setting, unnecessary account introspection increases privacy and reconnaissance risk if the skill is invoked or repurposed by untrusted workflows.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Text chat and video generation capabilities are unrelated to the stated image-only character-consistency purpose, yet they remain fully implemented in the same file. This unnecessary breadth makes the skill easier to misuse as a generic multimodal API proxy, increasing the chance of unauthorized actions, cost abuse, or policy bypass in environments that intended to allow only image generation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is advertised as a narrowly scoped Nano Banana 2 character-consistency image generator, but it also exposes generic task querying and standalone upload operations. This expands the tool's operational surface beyond user expectations, enabling use as a generic API helper for arbitrary media handling and task inspection, which can bypass least-privilege assumptions in agent environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing natural language exclusively in Chinese across the substantive changelog entries. Under the policy rule, forcing a specific language without user opt-in or justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Line L76 states '固定使用 Nano Banana 2' ('always use Nano Banana 2'), which is a natural-language instruction that forces a specific option rather than offering user choice. While this is not a language locale issue, it is the only plausible policy-like constraint present; however, it is weakly concerning and not clearly justified in the document.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example API key placeholder uses Chinese text ("请替换为你的APIKey"), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may choose another language, so this conflicts with the language/locale policy guidance.
- Content
Static analysis
No suspicious patterns detected.