Nano Banana 2 电商主图

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:00 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a real AI product-image generator, but it needs review because its setup and downloads are not tightly controlled.

Review before installing. Use an isolated virtual environment, pin dependencies if possible, only upload images you are comfortable sending to AI Hive, and avoid running downloads in sensitive directories until filename containment is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:76; additional references at scripts/imagegen.py:7 and scripts/imagegen.py:19-22
Vulnerability Type: Unverified and unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

pip3 install requests

The script also instructs users to perform the same unconstrained installation when the dependency is unavailable:

python

try:
    import requests
except ImportError:
    print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The installation command does not pin requests to a reviewed version and does not use a lockfile, package hash, or explicitly trusted package index. Consequently, the code installed when users follow the documented setup procedure may change independently of the reviewed Skill package.

The package name itself is legitimate and there is no evidence that the project intentionally installs a malicious dependency. Nevertheless, installation from the active pip configuration creates a supply-chain boundary that is not controlled by this project. A compromised upstream release, malicious package-index mirror, DNS or repository compromise, or unsafe user-level pip configuration could cause different code to be installed.

Python packages may execute code during installation or when imported. The script imports requests immediately at startup, so a substituted package could execute with the privileges of the user running the Skill.

Attack Path

1. An attacker compromises the configured Python package source, a dependency release, or a package mirror used by the victim.
2. The user follows the documented pip3 install requests instruction.
3. pip resolves and installs the attacker-controlled or otherwise unreviewed package version because no version or hash is enforced.
4. Malicious code executes during installation or when imagegen.py imports t ...[truncated 711 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests and all transitive dependencies to reviewed versions in a requirements or lock file.
2. Include cryptographic hashes and install with hash verification, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate the lock file through a controlled dependency-review process and update it only after security testing.
4. Document the trusted package index explicitly rather than relying on arbitrary global or user pip configuration.
5. Run dependency vulnerability scanning in CI and establish a controlled process for applying security updates.
6. Recommend installation in an isolated virtual environment without elevated privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:350

Finding

Path Traversal Through Untrusted Task Metadata in Download Filenames

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:350-365; file write occurs at scripts/imagegen.py:259-272
Vulnerability Type: Improper neutralization of externally supplied path components
Risk Level: Medium

Vulnerable Code

The output filename incorporates taskType and task_id without validating or removing path separators and traversal components:

python

task_type = task.get("taskType", "task")
for i, item in enumerate(succeeded):
    result_url = item.get("resultUrl")
    if not result_url:
        continue
    ext = ".mp4" if "video" in task_type.lower() else ".png"
    filename = f"{task_type}_{task_id}_{i+1}{ext}"
    out_path = out_dir / filename
    download_file(result_url, out_path)

# 尾帧
for item in succeeded:
    last_frame = item.get("lastFrameUrl")
    if last_frame:
        out_path = out_dir / f"{task_type}_{task_id}_lastframe.png"
        download_file(last_frame, out_path)

The constructed path is then opened for writing without verifying that it remains inside the configured output directory:

python

def download_file(url, out_path, timeout=300):
    """流式下载文件，带进度条显示。"""
    print(f"[download] {out_path.name}")
    try:
        resp = requests.get(url, stream=True, timeout=timeout)
        resp.raise_for_status()
        total = int(resp.headers.get("content-length", 0))
        downloaded = 0
        with open(str(out_path), "wb") as f:
            for chunk in resp.iter_content(chunk_size=8192):
                if chunk:
                    f.write(chunk)

Technical Analysis

task_type is obtained from the remote task response, while task_id is derived from generation response data and is passed into the polling routine. These values cross a remote trust boundary but are used directly as filename components.

A value containing path separators or traversal sequences such as ../ can cause `out_dir / fil ...[truncated 2181 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not use remote task metadata directly in local filenames. Prefer locally generated random identifiers or strictly validated server identifiers.
2. Apply an allowlist to every filename component, permitting only a limited character set such as ASCII letters, digits, periods, underscores, and hyphens.
3. Explicitly reject /, \, null bytes, absolute paths, empty components, and . or .. traversal components.
4. Resolve both the output directory and candidate destination, then verify containment before writing:

   python

   base = Path(output_dir).resolve()
   candidate = (base / safe_filename).resolve()
   if candidate.parent != base:
       raise SystemExit("Unsafe output path")
   

5. Use exclusive or atomic file creation where overwriting is unnecessary. If replacement is intended, require explicit user confirmation.
6. Apply the same validation to normal result filenames and last-frame filenames.
7. Consider enforcing maximum filename lengths to prevent filesystem errors and denial-of-service conditions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes shell commands, installs dependencies, reads environment-derived paths, writes files, and makes network requests, yet it declares no explicit tool scope or permissions boundaries. This increases the chance that an agent or user will run the skill with broader-than-necessary capabilities, enabling unintended file access, secret exposure, or network misuse if the script is modified or misused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says "Use this skill for" followed by a very broad list including generic terms like 商品主图, 商品首图, 搜索缩略图, and 多渠道上新. In a markdown skill description, this lacks clear trigger boundaries or exclusion conditions, making unintended invocation more likely for ordinary product-image requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 63% confidence

Finding

The file presents the skill primarily in Chinese and directs use through Chinese-language examples without stating that users may choose another language. This can be a language/locale policy issue when a skill effectively forces a language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill discloses only deep in the document that it uploads user-specified images to a remote API and saves generated outputs locally. Because this notice is not prominent near the main usage instructions, users may provide sensitive product images or proprietary assets without informed consent, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This JSON file contains a user-facing placeholder string in Chinese ("请替换为你的APIKey"). Because the skill provides only one language with no opt-in or documented locale constraint, it may violate the language/locale policy for natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains user-facing documentation and CLI strings in Chinese only, starting with the module docstring and continuing throughout the script. Under the language/locale policy rule, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a focused image-generation skill for Nano Banana 2 ecommerce main images, but the CLI also provides a standalone task command that can query arbitrary generation task IDs. While related to generation workflows, this broad task-inspection capability is not clearly justified by the narrowly stated purpose of producing channel-adapted product images.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest presents the skill as generating ecommerce main images with Nano Banana 2, but the code also offers an independent upload command that uploads images and returns reusable mediaId values. That capability is more like a general media-management helper than a necessary end-user function for the stated focused skill purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.