Security audit

Nano Banana 2 精准文字图片

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for AI image generation, but its helper script handles remote URLs and output filenames too broadly, so it should be reviewed before installation.

Install only if you are comfortable giving this skill an AI Hive API key, uploading chosen reference images to the service, and letting it write generated outputs locally. Prefer running it in a virtual environment, pin `requests`, use a dedicated low-privilege API key, and set a dedicated output directory until URL and filename validation are tightened.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:231
Finding: Unvalidated Server-Controlled URLs Enable SSRF and Arbitrary Resource Retrieval
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:350
Finding: Unsanitized Task Metadata Allows Output-Directory Traversal and File Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:73
Finding: Unpinned Third-Party Dependency Installation Creates Supply-Chain Risk
Content: View full analysis
``` The script repeats the same unpinned installation guidance: ```python """AI Hive image generation task utility. Only exposes fixed-model image generation, permitted reference-image uploads, task queries, and API key initialization. Dependency: requests (pip3 install requests) """ ``` ```python try: import requests except ImportError: print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The installation command does not pin a reviewed version, verify package hashes, or identify a trusted package index. The actual installed artifact therefore depends on the package index and resolver configuration present when the command is executed. The package name `requests` is legitimate and no malicious dependency is embedded in the project. The risk arises from non-reproducible installation and from trusting the active pip index without integrity constraints. A compromised package release, malicious index mirror, altered pip configuration, or dependency-resolution attack could cause unexpected code to be installed. Python packages can execute code during installation, and imported package code executes with the privileges of the invoking user. Because this script imports `requests` immediately at startup, a hostile installed package would also execute when the Skill runs. ### Attack Path 1. The user follows the documented `pip3 install requests` instruction. 2. The user's pip configuration p ...[truncated 1015 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes local scripts with shell, file, environment, and network capabilities but does not declare any explicit tool scope or permissions boundaries. That mismatch increases the chance an agent will grant broader access than necessary, making unintended file access, secret exposure, or outbound requests harder to govern and audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description lists a wide range of common use cases such as Chinese posters, English titles, ecommerce selling-point cards, social covers, packaging concepts, and marketing assets across many platforms. For a markdown skill file, this broad phrasing lacks explicit trigger constraints or exclusion conditions, which could cause the skill to be invoked for ordinary image-design requests beyond its intended narrow purpose of exact-text image generation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module docstring and all user-facing CLI guidance are written entirely in Chinese, and the file includes no indication that other languages are supported or that Chinese is an intentional, documented locale constraint. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: For an image-generation skill, automatically opening a browser and appending from=cli-skill&skill=... for backend attribution is not a direct requirement of generating exact-text images. This capability introduces external tracking/attribution behavior that is unjustified by the manifest's stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The manifest emphasizes controlled generation for accurate text placement and verification, but the code forwards unrestricted --param key=value model parameters into the API request. This creates a more open-ended image-generation surface than the description suggests, because callers can influence model behavior beyond the documented exact-text controls.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest frames this skill as a Nano Banana 2 exact-text image generation/editing tool with controls for text accuracy. However, the CLI also exposes a generic task command to inspect arbitrary generation tasks and an upload command to upload reference images independently of generation, which are broader utility operations not described in the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.