Security audit

Nano Banana Pro 广告图片

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a purpose-aligned AI Hive image-generation skill, with normal API-key and media-upload risks plus an unpinned dependency install to review.

Install in a virtual environment if possible, review or pin the requests dependency, and only upload media you are comfortable sending to AI Hive. Keep the API key private, verify the base URL remains the intended AI Hive endpoint, and be aware generated files are saved locally by default.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:69
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` Then document installation as: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install \ --index-url https://pypi.org/simple \ --require-hashes \ -r requirements.txt ``` The requirements file must include pinned versions and verified hashes for all transitive dependencies, not only `requests`. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes shell commands, performs package installation, and uses a Python script that likely needs filesystem and network access, yet it declares no explicit tool scope or permissions. This creates unnecessary ambient authority: an agent/runtime may grant broader capabilities than intended, increasing the blast radius if the skill is misused, modified, or its inputs are attacker-controlled.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and all operating instructions are written as mandatory Chinese-language guidance, including examples and workflow steps, with no indication that users may choose another language or locale. This creates a natural-language locale policy concern because the skill appears to impose a specific language by default rather than offering opt-in or documenting a region-specific limitation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level docstring says this file is a '通用 AI 能力调用工具' and explicitly claims support for text chat, image generation, video generation, model queries, media upload, and task polling. That directly conflicts with the packaged skill identity at the bottom of the file, which fixes the model and presents the artifact as a Nano Banana Pro advertising-image skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and user-facing instructions are written entirely in Chinese, and the script continues this pattern throughout prompts and status messages. This enforces a specific language experience without any user opt-in or documented locale justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a focused skill for creating/editing Nano Banana Pro advertising images, but the shipped skill entrypoint also includes task, upload, and init commands, and the file contains broader generic API tooling including user-info/model listing logic. While task polling and uploads are expected support functions, interactive API key onboarding and generic service-management capabilities go beyond the narrowly described ad-image creation behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese across the substantive entries. Under the policy, forcing a specific language without user opt-in or documented justification is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The sample API key placeholder uses Chinese text ("请替换为你的APIKey"), which imposes a specific language in user-facing configuration content. The file does not offer an alternative language or explain a locale-specific requirement, so it may violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: cmd_init opens a web browser and walks the user through obtaining credentials, which is an account bootstrap capability rather than an image-generation capability. The manifest describes producing ad creatives via Nano Banana Pro, not launching external pages or performing credential setup flows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.