Security audit

Nano Banana 2 图片编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an AI Hive image-editing wrapper, but it handles a bearer API key in ways that can send it to a user-configurable endpoint and includes broader helper code than the advertised image-only purpose.

Install only if you trust the AI Hive endpoint and will keep the default base URL. Avoid setting AI_HIVE_BASE_URL or --base-url to untrusted hosts, use a limited API key if available, install dependencies in a virtual environment, and review where outputs are downloaded before running it on sensitive images.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:70
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:91
Finding: Bearer API Key Can Be Sent to an Arbitrary Configurable Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:399
Finding: Remote Task Metadata Is Used in Download Paths Without Sanitization
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file is presented as a specialized Nano Banana 2 image-edit skill, but the implementation bundles a generic AI Hive client supporting chat, model listing, media upload, image generation, and video generation. This violates least-privilege for skills: if an agent can invoke this script beyond the intended wrapper, it gains materially broader capabilities than the manifest suggests, enabling policy bypass or unauthorized use of other model types.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The embedded text-chat capability allows arbitrary prompt submission to any text model, which is outside the declared Nano Banana 2 image-edit purpose. If reachable, an agent could use this skill as a general LLM access channel, bypassing capability restrictions, logging expectations, or approval flows meant to limit the skill to image editing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file includes arbitrary video-generation support with image/video/audio uploads and frame controls, far exceeding the declared image-edit scope. This materially broadens execution capability and cost/risk exposure, enabling misuse of the skill for unrelated media generation workloads or policy evasion through an apparently benign image-edit tool.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell commands, installs packages, reads local image files, and calls a networked script, but it does not declare any explicit tool or permission scope. That creates an over-privileged execution model where an agent may grant broader file, shell, environment, and network access than the task actually needs, increasing the blast radius if the skill or its helper script is abused or compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description and the entire skill instructions are written in Chinese, and there is no indication that users may interact in another language or locale. Under the stated policy, a skill that effectively imposes a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring and parser branding describe a 'generic AI capability invocation tool' rather than a narrowly scoped image-edit skill. That mismatch increases the chance that orchestration layers, reviewers, or users misunderstand the skill’s true privileges, which is a security boundary issue when trust is granted based on manifest scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code embeds the primary skill description entirely in Chinese, and later CLI help and user-facing prompts are likewise presented only in Chinese. That can violate a language/locale policy when the skill forces one language without explicit user opt-in or an offered alternative.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Exposing a user-info/account inspection capability is unrelated to image editing and can disclose wallet balance or account metadata to contexts that should only have media-edit privileges. In a skill ecosystem, unnecessary account introspection expands available sensitive information and weakens compartmentalization.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Model enumeration and arbitrary model lookup are not needed for a fixed-purpose Nano Banana 2 skill and expose broader platform knowledge plus selection flexibility. In context, this makes abuse easier by helping an agent discover alternative models or route requests outside the intended narrow path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file contains user-facing natural language only in Chinese across the substantive changelog entries. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and there is no indication here that the skill is intentionally region-specific or that alternative locales are supported.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The string literal on L2 uses Chinese text ('请替换为你的APIKey') as the only instructional placeholder. This imposes a specific language in the file content without any user opt-in or documented locale-specific scope, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.