Security audit

Nano Banana 2 文生图

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI Hive text-to-image helper with expected API-key storage and output downloads, though users should note ordinary dependency and download-hardening gaps.

Install only if you are comfortable giving this skill an AI Hive API key, sending your text prompts to AI Hive, and saving generated media locally. Prefer a pinned dependency install, keep the API key scoped and revocable, and use a dedicated output directory because downloaded result files are accepted from provider-returned URLs without strong validation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

Location: SKILL.md:69
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:181
Finding: Unvalidated Server-Directed File Downloads
Content: View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) print() size_mb = downloaded / (1024 * 1024) print(f"[ok] {out_path} ({size_mb:.1f} MB)") except requests.exceptions.RequestException as e: print(f"\n[error] 下载失败: {e}", file=sys.stderr) ``` Server-provided URL handling from `scripts/imagegen.py:269-282`: ```python for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) # 尾帧 for item in succeeded: last_frame = item.get("lastFrameUrl") if last_frame: out_path = out_dir / f"{task_type}_{task_id}_lastframe.png" download_file(last_frame, out_path) ``` ### Technical ...[truncated 2452 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes a local Python script that can use shell, network, and local file operations, but the manifest does not declare any tool scope or permission boundaries. That makes the skill's effective capabilities opaque to the platform and user, increasing the risk of overbroad execution, unsafe file access, or unexpected outbound requests if the script changes or is misused.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says to use this skill for broad phrases such as “AI绘图”, “快速出图”, “插画”, and “场景设计”, which are common everyday creative requests rather than narrow invocation triggers. It does not provide exclusion conditions or negative examples, so the activation scope is ambiguous and could cause unintended invocation for generic image-related asks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill content is written entirely in Chinese and does not state that the user may choose another language or locale. For a general-purpose text-to-image skill, this can be a language policy issue because it implies a fixed language experience without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language content in this file is presented exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or justification is provided. The stated policy requires flagging cases where a skill forces a specific language without offering choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. The file does not provide an alternative locale or indicate that the language choice is optional or region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.