Security audit

Nano Banana 2 海报生成

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AI poster-generation skill, but its downloader trusts API-controlled filenames and URLs in ways that could write files outside the intended output folder or send selected images to unexpected hosts if the API response is compromised.

Review before installing. Use this only if you trust the AI Hive API and are comfortable storing an AI Hive API key locally. Prefer running it in a constrained environment, avoid sensitive reference images, use a dedicated output directory, and consider fixing filename and URL validation before routine use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:350
Finding: Server-Controlled Task Metadata Enables Arbitrary File Writes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:231
Finding: Unvalidated API-Provided URLs Permit Arbitrary Outbound Requests and Reference-Image Redirection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:72
Finding: Unpinned Third-Party Dependency Installation Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes local Python scripts, installs dependencies, performs file writes for API key storage, reads local images, and sends network requests, but it does not declare any explicit tool scope or permissions boundaries. This creates an authorization ambiguity where an agent may expose shell, filesystem, environment, and network capabilities more broadly than users expect, increasing the chance of unintended data access or execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description says to use this skill for broad phrases like '海报生成' and many generic poster types such as event, exhibition, recruitment, promotion, and marketing visuals. It does not define clear activation boundaries, exclusions, or negative examples, so ordinary design requests could ambiguously trigger this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 70% confidence
Finding: The instruction '固定使用 public_model_nano_banana_2' imposes a fixed operational choice, and the document is primarily written in Chinese while the description mixes Chinese and English without clarifying language preference handling. If this skill is used in broader contexts, the lack of explicit user language/locale choice may conflict with policies requiring opt-in for language or locale constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example placeholder text 请替换为你的APIKey is written only in Chinese, which imposes a specific language in user-facing configuration guidance. There is no accompanying alternative language, opt-in, or documented justification that this file is intended only for a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.