Security audit

Nano Banana 2 商品精修

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its product-image retouching purpose, but it needs Review because API-provided result metadata can affect where files are written locally.

Install only if you trust the AI Hive service and are comfortable uploading the selected product images and prompts to it. Prefer using a dedicated API key, a non-sensitive output directory, and a pinned dependency install; review or patch the output-path, download-size, URL-validation, and API-key file-creation issues before using it with sensitive catalog assets.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T08 · Insecure Dependencies

Note

Location: SKILL.md:74
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` - Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` - Use an explicitly configured, trusted package index. - Add automated dependency vulnerability and integrity checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:225
Finding: API-Controlled Image Upload Destination Is Not Validated
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:260
Finding: Unbounded Downloads from API-Controlled Result URLs
Content: View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) print() size_mb = downloaded / (1024 * 1024) print(f"[ok] {out_path} ({size_mb:.1f} MB)") except requests.exceptions.RequestException as e: print(f"\n[error] 下载失败: {e}", file=sys.stderr) ``` The URL is obtained from remote task metadata: ```python for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) # 尾帧 for item in succeeded: last_frame = item.get("lastFrameUrl") if last_frame: out_path = out_dir / f"{task_type}_{task_id}_lastframe.png" download_file(last_frame, out_path) ``` ### Technical Analysis The download URLs originate in API task responses. Before requesting them, the client does not validate their scheme or hostname. `requests.get` follows redire ...[truncated 1543 chars]
Remediation: View remediation
MAX_DOWNLOAD_BYTES: raise ValueError("Download exceeds the configured size limit") f.write(chunk) ``` - Verify the response content type against an allowlist such as `image/png`, `image/jpeg`, or other specifically supported formats. - Write to a private temporary file and atomically rename it only after all validation succeeds. - Delete partial files when a request, validation, or write operation fails. - Use separate connection and read timeouts and consider an explicit overall transfer deadline. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:346
Finding: Remote Task Metadata Can Escape the Output Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:498
Finding: API Key Configuration File Is Secured Only After Sensitive Data Is Written
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes a Python script that performs network access, file reads/writes, shell execution, and likely environment access, but the manifest declares no explicit tool scope or permissions. This creates an over-privileged and weakly governed execution model where a host agent may grant broader capabilities than intended, increasing the risk of unintended file access, secret exposure, or outbound data transfer if the script or prompts are modified or misused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring and the user-facing CLI guidance are written exclusively in Chinese, and the skill does not indicate that other languages are supported or provide any opt-in language selection. This creates a natural-language locale constraint that is not documented as region-specific or optional.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.