Nano Banana Pro 电商主图

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:04 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches an AI image-generation workflow, but it needs review because its script carries broader AI Hive capabilities and has unsafe remote-result download handling.

Install only if you are comfortable giving this AI Hive workflow an API key and uploading selected product media to the configured AI Hive endpoint. Prefer a virtual environment, pin dependencies, keep the default trusted base URL unless you deliberately trust another endpoint, and avoid running it in directories where unexpected file writes could matter until the download path validation is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:70

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:70
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

bash

pip3 install requests

Technical Analysis

The documented setup command installs the latest version of requests available from the configured Python package index. It does not constrain the version, verify an integrity hash, or use a lock file.

Consequently, the dependency resolved during installation may differ from the version reviewed and tested by the project. If the package source, package-index account, configured mirror, or a future release is compromised, installation may introduce attacker-controlled code. Python packages can execute build-related code during installation, while malicious runtime code would execute when imagegen.py imports requests.

The project uses the legitimate package name requests, so there is no evidence of active typosquatting or dependency confusion. This finding represents an avoidable supply-chain weakness rather than evidence that the current dependency is malicious.

Attack Path

1. An attacker compromises a future dependency release, its publication channel, or a package mirror configured on the user's system.
2. A user follows the documented pip3 install requests instruction.
3. pip resolves and installs the uncontrolled version.
4. Malicious installation logic may execute immediately, or malicious package code may execute when imagegen.py imports requests.
5. The code runs with the privileges of the user invoking pip or the Skill.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the installing user. This could expose the AI Hive API key, prompts, reference media, generated files, and other files accessible to that user. It would not inherently grant administrative privileges unless installation is performed through an elevated account.

Remediation

View remediation

Remediation Suggestions

1. Declare a reviewed, exact dependency version in a requirements file:

   text

   requests==<reviewed-version>
   

2. Record hashes for the dependency and its transitive dependencies.
3. Install with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Periodically update the pinned version after vulnerability and compatibility review.
5. Recommend installation in an isolated virtual environment rather than into the system Python environment.
6. Where feasible, use an organization-controlled package mirror with provenance and integrity controls.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:381

Finding

Remote Task Metadata Is Used to Construct Download Paths Without Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:381-402
Vulnerability Type: Path traversal and unrestricted remote-result download
Risk Level: Medium

Vulnerable Code

python

# 下载结果
out_dir = Path(output_dir)
out_dir.mkdir(parents=True, exist_ok=True)
task_type = task.get("taskType", "task")
for i, item in enumerate(succeeded):
    result_url = item.get("resultUrl")
    if not result_url:
        continue
    ext = ".mp4" if "video" in task_type.lower() else ".png"
    filename = f"{task_type}_{task_id}_{i+1}{ext}"
    out_path = out_dir / filename
    download_file(result_url, out_path)

# 尾帧
for item in succeeded:
    last_frame = item.get("lastFrameUrl")
    if last_frame:
        out_path = out_dir / f"{task_type}_{task_id}_lastframe.png"
        download_file(last_frame, out_path)

The destination is ultimately opened for writing by download_file:

python

resp = requests.get(url, stream=True, timeout=timeout)
resp.raise_for_status()
total = int(resp.headers.get("content-length", 0))
downloaded = 0
with open(str(out_path), "wb") as f:
    for chunk in resp.iter_content(chunk_size=8192):
        if chunk:
            f.write(chunk)

Technical Analysis

The output filenames include taskType and taskId without removing path separators, absolute-path prefixes, or traversal components. At least taskType and generated task identifiers can originate from API responses. The destination is joined using out_dir / filename, but the resolved path is never checked to ensure that it remains beneath output_dir.

A malicious or compromised API can therefore return metadata containing values such as ../ path components. Depending on the supplied value and platform path semantics, the resulting file can escape the selected output directory. An absolute filename can also cause pathlib path joining to discard the preceding output directory. ...[truncated 2172 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not derive local filenames from remote task metadata. Generate filenames locally using a UUID or a strictly validated identifier.
2. If metadata must be retained, reduce it to a safe basename and allow only a conservative character set such as letters, digits, underscores, and hyphens.
3. Resolve and validate every destination before writing:

   python

   root = Path(output_dir).resolve()
   destination = (root / safe_filename).resolve()
   if root not in destination.parents:
       raise SystemExit("Unsafe output path")
   

4. Open new output files with exclusive creation where overwriting is unnecessary.
5. Permit only HTTPS result URLs.
6. Validate result and redirect destinations against an explicit allowlist of trusted media hosts.
7. Disable automatic redirects or validate every redirect hop before following it.
8. Apply maximum download-size limits while streaming, rather than relying solely on Content-Length.
9. Consider rejecting private, loopback, link-local, and reserved destination addresses if result hosts cannot be strictly allowlisted.
10. Treat custom --base-url and AI_HIVE_BASE_URL values as sensitive trust-boundary settings and clearly warn that the bearer API key is sent to the selected endpoint.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose is narrowly scoped to ecommerce main-image generation, but the referenced implementation appears to expose broader AI Hive functionality including chat, video, account/wallet access, model enumeration, uploads, and general initialization flows. Scope mismatch is dangerous because it can conceal sensitive capabilities behind an innocuous description, leading users or orchestrators to authorize a skill more broadly than intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file presents itself as a specialized Nano Banana Pro ecommerce main-image skill, but the module actually implements a broad generic AI client covering chat, image, video, model discovery, uploads, and task polling. This capability mismatch violates least-privilege expectations: a user invoking a narrowly described image skill may unknowingly expose API credentials and local media to unrelated features or workflows not justified by the skill’s stated purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring explicitly advertises a generic AI capability tool, which directly contradicts the specialized ecommerce-image identity under which the skill is being distributed. This kind of deceptive or misleading packaging undermines security review and user consent by concealing the true breadth of accessible operations behind a narrow skill label.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Video generation support materially exceeds the advertised ecommerce main-image scope and allows processing of images, videos, audio, and frame references through the same credentialed client. In this context, the mismatch is more dangerous because users expect a constrained single-image tool, not a multi-modal generation utility with broader media handling and potential for larger data transfers and abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains user-facing natural-language content entirely in Chinese across the changelog entries. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes shell commands, performs package installation, and uses a script that likely reads/writes files and accesses the network, yet it declares no explicit tool restrictions or permission boundaries. This increases the blast radius if the skill is triggered in an environment with broad agent capabilities, because users and reviewers cannot tell what operations are intended or allowed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description lists many broad use cases and keywords such as thumbnail optimization, testing, batch SKU work, multiple marketplaces, and ecommerce main images in general, but it does not define clear trigger phrases or exclusion conditions. This can cause unintended invocation for ordinary image-editing or marketplace-related requests that only partially match the description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and user-facing descriptions force a specific language/locale for interaction, but the file does not provide any opt-in, alternative language path, or justification that the skill is intended only for Chinese-speaking users. This can violate organizational language/locale policy when skills are expected to be usable without imposing a specific language by default.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

A user-info and wallet-balance endpoint is unrelated to generating ecommerce main images and grants visibility into account metadata that users would not expect this skill to access. In the context of a narrowly scoped creative skill, this broadens data exposure and can facilitate unnecessary account reconnaissance if the script or surrounding agent chooses to invoke it.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The text chat feature is outside the declared purpose of an ecommerce main-image skill and enables arbitrary prompt forwarding to a text model using the same API key and media-upload pipeline. This increases the attack surface by allowing unrelated data processing and makes the skill materially more capable than users or reviewers would infer from its description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The natural-language content is primarily written in Chinese while also embedding English marketplace terms, and there is no statement that the user may choose their preferred language or locale. This can violate language/locale policy when a skill effectively defaults to a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example API key placeholder uses Chinese text ("请替换为你的APIKey"), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that alternative locales are supported, so this appears to violate the language/locale neutrality requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.