ClawHub
Back to skill

Security audit

Nano Banana 2 营销图片

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI image-generation helper that uses a fixed external API, user-selected reference images, and local output files in ways that fit its stated purpose.

Install only if you are comfortable sending prompts and any reference images you choose to AI Hive, and treat the stored AI Hive API key like a password. Use only images you are authorized to upload, especially for brand, customer, or product materials.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill invokes local Python scripts, reads user-specified image files, writes results, accesses environment variables via shell execution context, and makes outbound network requests to an external API, yet it declares no permissions. This creates a capability/expectation mismatch that can lead to unsafe execution in environments that rely on explicit permission declarations for sandboxing, user consent, or policy enforcement.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.