Nano Banana 电商主图｜Nano Banana 2 商品图

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its downloader lets the remote image service influence local output paths and download size, which deserves review before installation.

Install only if you trust the AI Hive service and are comfortable uploading product reference images and storing an API key locally. Prefer running it in an isolated environment, use --no-download or a disposable output directory until the downloader is fixed, and avoid placing the output directory near important writable files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nano_main_image.py:216

Finding

Server-Controlled Task Identifier Enables Output Path Traversal

Content

View full analysis

Vulnerability Details

File Location: scripts/nano_main_image.py, lines 216–270
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: Medium

Vulnerable Code

python

task_id = response.get("taskId")
if not task_id:
    print(json.dumps(response, ensure_ascii=False, indent=2))
    return
print("[main-image]", args.platform, args.asset, "taskId =", task_id)
if args.required_text:
    print("[text-check] Contains specified text; manually verify it before publication")
if not args.no_download:
    wait_and_download(api, task_id, Path(args.output_dir))

python

if item.get("status") == "COMPLETED" and item.get("resultUrl"):
    safe_download(
        item["resultUrl"],
        output_dir / "{}_{}.png".format(task_id, index),
    )

Technical Analysis

The task identifier originates in a remote API response and crosses a trust boundary without validation. It is subsequently incorporated directly into the local output path.

Python's pathlib does not remove traversal components. A task identifier containing path separators and .. components can therefore cause the destination to resolve outside output_dir. An absolute task identifier can also supersede the preceding output directory. The download routine creates missing parent directories and opens the destination with wb, which truncates an existing file at the resulting path.

Exploitation requires control over, or compromise of, the configured AI Hive API response. HTTPS reduces network interception risk but does not protect against a compromised service, compromised service credentials, or malicious server-side behavior.

Attack Path

1. An attacker gains the ability to control responses from the configured AI Hive service.
2. The image-generation response returns a crafted taskId, such as one containing directory traversal components.
3. The script accepts the identifier and passes i ...[truncated 963 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use a server-provided task identifier as a local filename. Generate a local random filename instead and store the task identifier only as metadata.
• If the identifier must appear in the filename, enforce a strict allowlist such as ^[A-Za-z0-9_-]{1,128}$.
• Resolve both the output directory and candidate destination, then verify that the destination remains beneath the output directory using Path.resolve() and Path.relative_to().
• Reject absolute paths, path separators, traversal components, control characters, and platform-specific separator variants.
• Avoid silent replacement by opening new output files in exclusive mode or requiring explicit overwrite approval.
• Write into a temporary file inside the validated output directory and atomically rename it after download and content validation succeed.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nano_main_image.py:238

Finding

Unbounded and Unvalidated Remote Result Download

Content

View full analysis

Vulnerability Details

File Location: scripts/nano_main_image.py, lines 238–248
Vulnerability Type: Unrestricted remote download and resource exhaustion
Risk Level: Medium

Vulnerable Code

python

if urlparse(url).scheme != "https":
    raise SystemExit("The result download URL must use HTTPS")
destination.parent.mkdir(parents=True, exist_ok=True)
try:
    with requests.get(url, stream=True, timeout=300) as response:
        response.raise_for_status()
        with destination.open("wb") as handle:
            for chunk in response.iter_content(8192):
                if chunk:
                    handle.write(chunk)

Technical Analysis

The script only checks that the initial URL uses the HTTPS scheme. It does not restrict the hostname, validate redirect destinations, impose a maximum response size, or verify that the downloaded content is a valid image.

Streaming prevents the entire response from being loaded into memory, but it does not limit the number of bytes written to disk. The configured timeout is not a total download-size limit. A server can continue sending data while satisfying socket timeout behavior. In addition, requests follows redirects by default, while the code does not revalidate the scheme and host of each redirect target.

The downloaded response is saved with a .png extension regardless of its media type or actual contents. Partial files are also not removed when a transfer fails after writing begins.

Attack Path

1. An attacker controls or compromises the API response used for task status.
2. The response provides a completed item with an attacker-selected HTTPS resultUrl.
3. The script accepts the URL because its initial scheme is HTTPS.
4. The endpoint returns an extremely large or indefinitely streamed response, or redirects to another untrusted destination.
5. The script writes every received chunk without a byte limit.
6. Available disk s ...[truncated 630 chars]

Remediation

View remediation

Remediation Suggestions

• Allowlist the expected result-download hosts and reject all other hosts.
• Disable automatic redirects or validate the scheme, hostname, port, and resolved destination after every redirect.
• Require HTTPS throughout the complete redirect chain.
• Enforce a conservative maximum download size using both Content-Length and a running byte counter while streaming.
• Abort and delete the partial file immediately if the maximum size is exceeded.
• Verify the response media type, inspect image magic bytes, and decode the completed file with a maintained image library before accepting it.
• Store downloads in temporary files and atomically rename them only after all validation succeeds.
• Apply limits to image dimensions and decompressed pixel count to prevent image decompression bombs.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:101

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 101
Vulnerability Type: Unpinned dependency and non-reproducible installation
Risk Level: Low

Vulnerable Code

bash

pip3 install requests

Technical Analysis

The installation instruction retrieves the latest version of requests available from the user's configured Python package index. It does not pin an audited version, verify package hashes, specify a trusted index, or recommend an isolated environment.

Consequently, installation results can change over time and depend on local package-index configuration. A compromised package-index account, malicious package mirror, or future incompatible release could introduce unreviewed code into the Skill's runtime environment. No evidence was found that the named requests package is itself malicious; the issue is the unsafe and mutable dependency installation process.

Attack Path

1. A user follows the documented installation command.
2. pip resolves requests and its transitive dependencies using mutable package-index state and local index configuration.
3. A compromised upstream release, malicious configured mirror, or otherwise unreviewed future version is selected.
4. The dependency is installed and subsequently imported by the Skill.
5. Malicious or vulnerable dependency code executes with the privileges of the user running the installation or the Skill.

Impact Assessment

Impact depends on the contents of the package obtained at installation time. A compromised dependency could access API keys, product images, generated files, network resources, and other data available to the current user. This finding does not demonstrate an active dependency compromise and is therefore rated Low.

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to reviewed versions in a lock file.
• Require cryptographic hashes, for example through a hash-locked requirements file and pip install --require-hashes.
• Document the approved Python package index explicitly and require HTTPS certificate validation.
• Install dependencies in a dedicated virtual environment rather than the user's global Python environment.
• Add automated dependency vulnerability and integrity scanning to the release process.
• Review and update pinned versions through a controlled maintenance workflow.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes local Python scripts, installs dependencies, reads reference files, may write outputs, uses environment-derived paths like SKILL_PATH, and makes outbound network requests, yet it declares no explicit tool scope or permissions. This creates an unnecessary trust gap: a host agent may allow broader shell/file/network access than users expect, increasing the blast radius if the script is modified, misused, or supplied with unsafe inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The placeholder value includes the instruction '请替换为你的APIKey' ('please replace with your API key') only in Chinese. Because this file provides a user-facing example without offering a language choice or documenting a locale-specific constraint, it imposes a specific language in a way that can violate language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing descriptions and error/help text entirely in Chinese, starting with the module docstring and continuing through CLI-visible messages. Under the policy rule for language/locale, this effectively forces a specific language without any opt-in or alternative locale support.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.