ClawHub
Back to skill

Security audit

Nano Banana 2 图生图

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed image-to-image helper that uploads user-selected images to AI Hive and stores its API key locally for that purpose.

Install only if you are comfortable sending the images and prompts you choose to AI Hive. Keep the API key private, review ~/.ai-hive/config.json if you initialize credentials, and avoid uploading sensitive or private images unless that matches your intended use.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill invokes a local Python script with shell commands, reads and writes local configuration files, uses environment-derived paths such as SKILL_PATH, and makes outbound network requests to a remote API, yet it declares no permissions. This creates a transparency and consent problem: a user or platform may underestimate the skill's access to local files, shell execution, and network exfiltration pathways, especially because it uploads user-selected images and stores API keys locally.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.