Security audit

Nano Banana Pro 图片换背景

Security checks for vulnerabilities and agentic risk

Overview

This image background-replacement skill is mostly coherent, but it can send the user's AI Hive API key to any configured base URL, which deserves review before installation.

Install only if you trust AI Hive and are comfortable uploading selected images to it. Use a dedicated, low-privilege API key, avoid setting --base-url or AI_HIVE_BASE_URL unless you fully trust the endpoint, and prefer an isolated virtual environment with a pinned requests version.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:69
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:61
Finding: Bearer API Key Can Be Sent to an Arbitrary or Cleartext Base URL
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is narrowly about background replacement, but the detected behavior reportedly includes unrelated capabilities such as generic chat, video generation, user-info/wallet access, model discovery, uploads, and interactive initialization. This mismatch is dangerous because it can hide a much broader attack surface than users expect, enabling data access, account interaction, or exfiltration paths under the cover of an image-editing skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill exposes shell, network, file read/write, and environment-dependent execution examples but does not declare any explicit tool scope or permissions boundary. That makes the effective capability set broader than what a reviewer or runtime policy can infer from the manifest, increasing the risk of unexpected command execution, network access, or filesystem interaction if the skill is invoked in a permissive environment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring describes a general-purpose AI capability wrapper for chat, image, video, upload, and polling, while the published skill claims to be a specialized background-replacement tool. That discrepancy can mislead reviewers and operators about the actual reachable functionality, increasing the chance that broader capabilities are exposed under a narrowly trusted label.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing natural-language descriptions entirely in Chinese, including the module docstring and many CLI prompts, which effectively forces a specific language/locale on users. The file does not provide any opt-in, fallback, or explicit justification for this locale restriction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as a narrowly scoped Nano Banana Pro background-replacement tool, but the exposed generate path forwards arbitrary prompts, batch sizes, routing, and free-form --param values into a generic image generation backend. This mismatch weakens least-privilege expectations and allows callers to use the skill for broader model behaviors than the advertised purpose, which can bypass policy, review, or operational controls that rely on the declared skill scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains substantive user-facing release notes in Chinese, but nowhere indicates that the skill is region-specific or that users can choose another language. Under the natural-language policy rule, forcing a specific language without opt-in can be a locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The placeholder value 请替换为你的APIKey is Chinese-only instructional text embedded in the config example. This imposes a specific language in user-facing guidance without opt-in or documented locale scope, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.