ClawHub
Back to skill

Security audit

Nano Banana 2 产品图生成

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AI Hive product-image generator with disclosed API-key use, reference-image upload, and result download behavior.

Before installing, expect to provide an AI Hive API key and to upload only product/reference images you are authorized to use. Prefer an isolated Python environment and pinned dependencies, and review where generated images are saved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:75
Finding

Unpinned Third-Party Python Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 75
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Complete Code Snippet

bash
pip3 install requests

The dependency is imported by scripts/imagegen.py:

python
try:
    import requests
except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The documented installation command retrieves the current version of requests and its transitive dependencies without version constraints or cryptographic integrity hashes. Consequently, installations are not reproducible and automatically trust whichever compatible artifacts the package index serves at installation time.

This creates supply-chain exposure if a package maintainer account, release process, distribution index, or dependency is compromised. It can also introduce unreviewed behavioral changes through an incompatible future release. This finding does not establish that the current requests package is malicious; it identifies the absence of dependency pinning and integrity verification.

Attack Path

  1. An attacker compromises the package distribution account, index, release pipeline, or a transitive dependency used by requests.
  2. The attacker publishes or causes distribution of a malicious release.
  3. A user follows the documented pip3 install requests instruction.
  4. The package manager resolves and installs the attacker-controlled release because no exact version or hash is required.
  5. Malicious installation or runtime code executes with the privileges of the user running the command.
  6. The code may access data available to the process, including the AI Hive API key, prompts, reference images, generated outputs, and user-accessible files.

Impact Assessment

Successful exploitation could execute arbitrary code with the installing or invoking user’s privileges. The affected scope includes the ...[truncated 335 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a reviewed dependency manifest and pin requests and every transitive dependency to exact versions.
  2. Generate and record cryptographic hashes for all approved distribution artifacts.
  3. Require hash validation during installation, for example:
bash
python3 -m pip install --require-hashes -r requirements.txt
  1. Generate the locked dependency set in a controlled environment using a tool such as pip-tools, and review dependency updates before regenerating it.
  2. Use an isolated virtual environment rather than installing into the system Python environment.
  3. Integrate dependency vulnerability and provenance scanning into the release process.
  4. Replace the unpinned installation instruction in SKILL.md and the corresponding guidance in scripts/imagegen.py with the locked, hash-verified installation command.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes a Python script with shell, file, environment, and network capabilities but does not declare any tool scope or restrictions. That increases risk because an agent may grant broader-than-necessary access, allowing unintended file reads/writes, secret exposure, or outbound requests beyond the user's expectations if the skill is executed in a permissive runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s operative instructions and examples are written entirely in Chinese, while the description also includes English discovery terms. This creates a language/locale constraint for using the skill but does not explicitly offer the user a language preference or opt-in, which matches the policy-violation category for forced language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains user-facing natural-language strings exclusively in Chinese, starting with the module docstring and continuing throughout the CLI UX. Under the policy rule, forcing a specific language without presenting a language or locale choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.