Security audit

Nano Banana Pro 角色一致性图片

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but it needs review because its API key can be sent to any configured API endpoint without HTTPS or host checks.

Install only if you are comfortable giving this skill an AI Hive API key and uploading the reference images you explicitly pass on the command line. Use the default official HTTPS base URL, avoid setting AI_HIVE_BASE_URL or --base-url unless you fully trust that endpoint, and consider installing dependencies in a virtual environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:86
Finding: API Key Can Be Transmitted to an Arbitrary or Plaintext Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:80
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
``` The script documentation repeats the same installation instruction: ```python """Nano Banana Pro character-consistency image tool. Only exposes fixed-model image generation, reference-image upload, task lookup, and API-key initialization. Dependency: requests (pip3 install requests) """ ``` ### Technical Analysis The project instructs users to install `requests` without a version constraint, lock file, or integrity hash. Package resolution therefore depends on the state of the configured Python package index at installation time. Although `requests` is the correct package name and there is no evidence that the project intentionally introduces a malicious dependency, the installation is not reproducible. A compromised package release, dependency, package index, mirror, or local pip configuration could cause unreviewed code to be installed. Python packages may execute code during installation and are imported into the image-generation process afterward. The imported package operates with the same local permissions as the user running the Skill. ### Attack Path 1. The user follows the documented `pip3 install requests` instruction. 2. Pip resolves `requests` and its transitive dependencies from the user's configured index or mirror. 3. An upstream release, transitive dependency, index, mirror, or pip configuration has been compromised. 4. Pip downloads and installs the compromised code without checking project-supplied hashes. 5. Malicious installation logic or imported runtime code executes with ...[truncated 833 chars]
Remediation: View remediation
``` 2. Generate and publish hashes for the package and all transitive dependencies, then require hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-generation tool such as `pip-tools`, Poetry, or another reproducible dependency manager. 4. Document the trusted package index explicitly and avoid unknown mirrors: ```bash python3 -m pip install --index-url https://pypi.org/simple --require-hashes -r requirements.txt ``` 5. Recommend installation inside a dedicated virtual environment rather than into the system Python environment. 6. Add automated dependency vulnerability and provenance scanning to the release process, and update pins through reviewed changes. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill exposes operational capabilities that imply shell execution, network access, and local file read/write, but it does not declare an explicit tool scope or permission boundary in the skill manifest. That omission increases the risk of overbroad execution, accidental data access, or misuse of the documented commands, especially because the workflow writes credentials to a local config file and performs uploads/downloads over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill’s title, instructions, examples, and operational guidance are predominantly written in Chinese and direct usage in that language, while not offering any opt-in or alternative locale choice. This can violate language/locale policy because the file effectively constrains users to a specific language without documenting that limitation or allowing selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains user-facing natural-language instructions, help text, and status messages in Chinese only. Because the skill does not offer user opt-in for language/locale or justify that it is a region-specific tool, it violates the policy against forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents substantive skill information only in Chinese, with no indication that users can choose another language or that the locale is intentionally constrained. That can violate language/locale policy when the skill documentation effectively forces a single language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example API key placeholder uses Chinese text only ("请替换为你的APIKey"), which imposes a specific language in user-facing configuration content. This is a natural-language locale policy concern because the file does not provide any opt-in, alternative locale, or justification for restricting the example to Chinese.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.