Nano Banana 2 图生图

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.1

Overview

This is a disclosed AI Hive image-to-image helper that uploads user-selected images and stores an API key locally, with minor setup and credential-handling cautions.

Before installing, use this only if you intend to send selected reference images and prompts to AI Hive. Store the API key through the 0600 config file or a carefully managed environment variable rather than the --api-key command line option, and consider installing dependencies in a virtual environment with pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:71

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:71-73 and scripts/imagegen.py:7, 19-22
Vulnerability Type: Unpinned dependency and non-reproducible installation
Risk Level: Low

Vulnerable Code

SKILL.md:71-73:

bash

pip3 install requests
python3 "$SKILL_PATH/scripts/imagegen.py" init --skill-name nano-banana-2-image-to-image
python3 "$SKILL_PATH/scripts/imagegen.py" task --task-id <taskId>

scripts/imagegen.py:19-22:

python

try:
    import requests
except ImportError:
    print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The documented installation command resolves the latest package version available from the Python package index configured on the user's system. The project provides no version constraint, lockfile, transitive dependency lock, or package integrity hashes.

The dependency name is legitimate and there is no evidence that this project deliberately installs a malicious package. Nevertheless, an unpinned installation is not reproducible and makes the effective dependency set change over time without a corresponding review of this Skill. Security regressions in later releases, a compromised package-index account, or a maliciously configured package index could cause unreviewed code to be installed.

This is a supply-chain hardening issue rather than evidence of an embedded malicious payload.

Attack Path

1. An attacker compromises a relevant package release, package-index account, dependency, or package source configured on the victim's system.
2. The victim follows the documented pip3 install requests instruction.
3. pip resolves and installs the attacker-influenced version because no approved version or hash is enforced.
4. The package is imported when imagegen.py starts.
5. Malicious import-time behavior executes with the privileges of the user running the Skill.

Impact Ass

...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

1. Add an audited dependency lockfile that pins requests and all transitive dependencies to exact versions.

2. Record cryptographic hashes and install using hash verification, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate and review lockfile updates through a controlled dependency-update process.

4. Recommend installation in an isolated virtual environment rather than into the global Python environment.

5. Configure installation to use an explicitly trusted package index.

6. Add automated dependency vulnerability and provenance checks to the release process.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/imagegen.py:373

Finding

API Key Can Be Supplied Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:47-51, 373-376, 543-547
Vulnerability Type: Sensitive credential exposure through command-line arguments
Risk Level: Low

Vulnerable Code

scripts/imagegen.py:47-51:

python

def _resolve_api_key(self, cli_key):
    if cli_key:
        return cli_key
    env_key = os.environ.get("AI_HIVE_API_KEY")
    if env_key:
        return env_key

scripts/imagegen.py:373-376:

python

def add_common_args(parser):
    parser.add_argument("--api-key", help="AI Hive API Key (sk-api-*)")
    parser.add_argument("--verbose", action="store_true", help="详细日志")

scripts/imagegen.py:543-547:

python

config = Config(
    api_key=getattr(args, "api_key", None),
    verbose=getattr(args, "verbose", False),
)
client = AiHiveClient(config)

Technical Analysis

The CLI accepts a bearer credential through --api-key. Command-line arguments are not an appropriate secret transport because they can be retained in shell history, terminal logs, support transcripts, process accounting, monitoring systems, or diagnostic output. Depending on the operating system's process-isolation policy, process arguments may also be observable by other local users or privileged monitoring services while the command is running.

The implementation also supports an environment variable and a configuration file protected with mode 0600, but the continued availability of the command-line option creates an avoidable credential-exposure path.

No hardcoded production credential was found, and the reviewed code does not intentionally print the complete API key. The exposure requires a user to select the unsafe CLI mechanism.

Attack Path

1. A user runs the tool with a command such as:

   bash

   python3 scripts/imagegen.py generate --api-key sk-api-secret-value \
     --prompt "..." --image reference.png
   

2. The secret ...[truncated 939 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option from all subcommands.
2. Prefer the existing mode-0600 configuration file or a dedicated secret manager.
3. If interactive entry is necessary, read the key with getpass.getpass() so it is not echoed or placed in shell history.
4. Retain environment-variable support only with documentation warning that environment variables may still be visible to privileged local processes and diagnostic tools.
5. Ensure logs, exceptions, and verbose output never include authorization headers or complete credentials.
6. Document key rotation and revocation procedures for users who previously supplied credentials through command-line arguments.
7. Consider using narrowly scoped and short-lived credentials where the service supports them.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a local Python script that can read files, write configuration, access environment-provided secrets, open shell commands, and make outbound network requests, yet the manifest declares no explicit tool scope or permissions boundary. That mismatch increases the chance of over-broad execution in a host agent, making accidental secret exposure, unintended file access, or network misuse harder to constrain or audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill’s natural-language instructions and examples are overwhelmingly presented in Chinese, and there is no statement that users may choose another language or locale. This creates a language/locale policy issue because the skill effectively imposes a specific language without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language content in this file uses Chinese exclusively for release notes, which can amount to a language policy issue when no user choice or justification is provided. The stated rule flags cases where a skill forces a specific language without user opt-in, and this changelog does not indicate any optionality or region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The placeholder value includes Chinese-only instructional text ("请替换为你的APIKey"), which imposes a specific language in user-facing configuration content. The file does not offer an alternative language or indicate that the locale is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.