Security audit

Nano Banana Pro 图片换背景

Security checks across malware telemetry and agentic risk

Overview

This skill is an API-backed image background replacement tool with expected credential, upload, and download behavior, though its documentation should better highlight the stored API key and helper commands.

Install only if you are comfortable giving this skill an AI Hive API key and uploading the specific images you choose to AI Hive. Review the prompts and file paths before running generate or upload, and consider using --no-download or a chosen --output-dir if you want tighter control over saved outputs.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill exposes shell, filesystem, environment, and network-capable workflows in documentation without declaring corresponding permissions. This creates a transparency and trust-boundary problem: a user or platform may invoke the skill believing it is narrowly scoped, while the referenced scripts can access local files, environment secrets, and remote services. In this context, the danger is increased because the skill claims a simple background-replacement purpose but operationally depends on a generic script entrypoint with broader capabilities.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This is a substantive scope mismatch: the skill is presented as a dedicated Nano Banana Pro background-replacement tool, but the underlying implementation reportedly supports general AI Hive API operations including chat, video generation, media upload, browser-based API-key setup, model enumeration, and account/wallet queries. Such hidden breadth is dangerous because it enables actions far beyond user expectations, increasing the chance of unauthorized data access, secret handling, prompt misuse, or invoking unrelated capabilities under a benign-looking skill name.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file is presented as a narrowly scoped Nano Banana Pro background-replacement skill, but the implementation contains a broad generic AI client supporting chat, image, video, model discovery, uploads, and task polling. This scope mismatch is dangerous because it gives users and downstream agents more capability than the declared skill contract, undermining least privilege and making it easier to repurpose the skill for unrelated operations.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: Although the skill fixes the model ID, it forwards arbitrary user-supplied --param key=value pairs directly into the image generation request. For a skill advertised as a fixed background-replacement capability, unrestricted parameter passthrough can expose undocumented model behaviors, bypass intended safety constraints, or enable outputs outside the expected editing-only scope.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill exposes standalone task lookup and media upload commands that are generic platform utilities rather than background-replacement-specific operations. This broadens the operational surface and enables the skill to act as a general media-management wrapper, which increases the chance of misuse, data handling outside user expectations, and policy bypass through capability creep.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.