T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:229- Finding
Unvalidated Server-Controlled URLs Enable Arbitrary Outbound Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
Nano Banana 2 商品详情页
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its image-generation purpose, but its helper script trusts remote service responses in ways that could contact unintended network locations or write files outside the chosen output folder.
Review before installing. Use it only with reference images you are comfortable sending to AI Hive, run it in a dedicated working directory or sandbox, prefer `--no-download` or a constrained output directory until filename handling is fixed, and install dependencies in a virtual environment with pinned versions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:340- Finding
Remote Task Metadata Can Escape the Configured Output Directory
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:76- Finding
Unpinned Runtime Dependency Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill invokes local shell commands, reads local reference images, writes configuration via init, and makes network requests to an external API, yet it declares no explicit permissions or allowed tool scope. That creates an authorization gap where an agent may expose broader capabilities than intended, making misuse or accidental overreach harder to constrain and audit.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description contains many broad ecommerce and design trigger terms, which can cause the skill to activate for generic product-page or marketing requests outside its narrow intended workflow. Over-broad routing is a security concern because it increases the chance that code-capable tooling and networked generation paths are invoked in contexts where a simpler, non-tool skill would have sufficed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring and user-facing CLI messages are written entirely in Chinese, and the workflow instructions require the user to follow Chinese-language prompts. The file does not offer any language/locale opt-in or indicate that the skill is intentionally restricted to a Chinese-speaking or region-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The file consistently instructs and exemplifies the skill in Chinese, including the core description and prompt templates, but does not state that users may choose another language or locale. This can be a language-policy issue when the skill is used in multilingual environments without explicit user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON file contains a natural-language string value that instructs the user in Chinese only ("请替换为你的APIKey"). The policy requires avoiding forced language or locale unless the skill offers user choice or clearly documents a justified regional constraint, which is not present here.
- Content
Static analysis
No suspicious patterns detected.