Security audit

Nano Banana 2 多参考图生成

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but its downloaded output filenames can be influenced by the remote service and may write outside the chosen output folder.

Review this skill before installing if you care about local file integrity. Use a dedicated output directory, avoid running it with elevated privileges, consider pinning dependencies yourself, and only store an API key locally if you are comfortable with ~/.ai-hive/config.json holding that credential.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:75
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Generate and verify cryptographic hashes for the dependency and all transitive dependencies. 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Replace all documented `pip3 install requests` instructions with installation from the pinned manifest. 5. Use a trusted package index explicitly and review dependency updates before changing the lock file. 6. Run dependency vulnerability scanning in CI and update pinned packages through a controlled review process. 7. Avoid recommending elevated or system-wide package installation. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:348
Finding: Path Traversal Through Server-Controlled Download Filename
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill invokes local Python scripts, performs package installation, stores API keys locally, and makes outbound network requests, but it does not declare any explicit tool scope or permissions. This creates an avoidable trust gap: a host may expose shell, filesystem, environment, and network capabilities more broadly than reviewers or users expect, increasing the chance of misuse, secret exposure, or unintended file/network access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains user-facing docstrings and CLI messages entirely in Chinese, and the initialization and runtime prompts also assume Chinese as the required interaction language. Under the policy rule, a skill should not force a specific language or locale unless it offers user choice or clearly documents a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The string value includes the instruction '请替换为你的APIKey', which forces Chinese-language guidance in a file that otherwise provides no user language selection or locale justification. This can violate organizational language/locale policy when skills are expected to remain language-neutral or offer opt-in localization.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest describes a skill for generating new images from multiple authorized reference images using Nano Banana 2. In addition to generation and reference-image upload, the code exposes a standalone task command that retrieves arbitrary generation task details by task ID, which is not clearly justified by the stated purpose of multi-reference image creation itself.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The manifest centers on using authorized reference images to generate a new image, where uploading references is an implementation step within that workflow. The code also exposes a separate upload command that returns reusable media IDs independently of generation, creating a more general remote media-upload capability than the manifest explicitly describes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.