Security audit

Nano Banana 2 直播带货图片

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is coherent, but it needs Review because server-provided upload and download data can affect where private images are sent and where files are written locally.

Use this only if you trust AI Hive and the storage destinations it returns. Avoid uploading sensitive or unreleased reference images, run it in a virtual environment, prefer a disposable output directory, and consider configuring the API key manually instead of using the browser init flow if skill-identifying account telemetry is a concern.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:263
Finding: Unvalidated Server-Controlled Download URLs and Output Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:231
Finding: Unvalidated Server-Selected Reference Image Upload Destination
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:72
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes shell commands, reads local files, writes results, uses environment variables like SKILL_PATH, and makes outbound network requests, but it does not declare a restrictive tool scope. That creates unnecessary ambient authority: a hosting agent may expose broader capabilities than intended, increasing the risk of misuse, data exposure, or command execution beyond the documented image-generation workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description is written as an instruction to use the skill for livestream image tasks in Chinese, and the skill content consistently assumes Chinese-language prompts and platform context without any opt-in or alternative language guidance. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless it is clearly documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file contains user-facing natural-language instructions, help, prompts, and status messages in Chinese, beginning with the module docstring. Because the skill does not offer language selection or explain that it is intended only for Chinese-speaking users, it effectively forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JSON manifest contains a natural-language placeholder in Chinese ("请替换为你的APIKey") embedded directly in the config example. Because the file provides no language choice, opt-in, or justification for restricting content to Chinese, it may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The init flow opens a browser to an account/API key page and appends a skill-identifying query parameter (?from=cli-skill&skill=...) for attribution. That tracking is not necessary to generate images and creates avoidable metadata leakage about which skill the user is using when they access a sensitive account-management page. In this skill context, the danger is limited because it does not directly exfiltrate the API key, but it is still an unnecessary privacy and telemetry risk around credential setup.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.