Security audit

Nano Banana Pro 精准文字图片

Security checks across malware telemetry and agentic risk

Overview

This skill coherently generates images through AI Hive, but users should be aware it stores an AI Hive API key locally and uploads chosen reference files to the service.

Install only if you are comfortable using AI Hive for image generation. The skill stores an AI Hive API key in ~/.ai-hive/config.json and uploads only files whose paths you provide, so avoid passing private or unrelated files as references. For stricter environments, prefer a version with the unused generic chat/video helper code removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell commands, performs package installation, reads/writes local files, uses environment variables, and makes network requests, yet declares no permissions. This creates a transparency and consent problem: users and platforms cannot accurately assess the skill’s operational reach, and hidden capabilities can be abused for unintended file access, data exfiltration, or arbitrary command execution workflows.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose is narrowly scoped to exact-text image generation, but the detected behavior includes broader capabilities such as generic chat, video generation, model enumeration, account lookup, media upload, and local API key setup/storage. This mismatch is dangerous because it expands the attack surface beyond user expectations, enabling collection of sensitive account data, broader data uploads, or misuse of credentials under the guise of a simple image skill.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The file is presented as a narrowly scoped exact-text image skill, but it actually ships a broad AI Hive client with multiple unrelated capabilities. In agent ecosystems, this scope mismatch is dangerous because a caller may trust the skill's declared purpose while hidden or undocumented capabilities enable broader network actions and data handling than expected.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill contains text-chat functionality that is unrelated to exact-text image generation. Extra capability increases attack surface and creates a trust-boundary problem: an agent or user expecting only image generation may unknowingly expose prompts, uploaded media, or API-backed interactions to a general chat endpoint.

Context-Inappropriate Capability

High

Confidence: 91% confidence
Finding: The included video-generation flow is materially outside the stated skill purpose and adds a much broader media-processing capability. That enlarges the blast radius by permitting additional uploads, task execution, polling, and downloads that a caller would not expect from an exact-text image skill.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The embedded skill configuration and surrounding documentation describe a specialized image skill, while the file still contains generic AI capability tooling. This contradiction can mislead downstream reviewers, orchestrators, or users about the actual permissions and behavior of the code, undermining security review and informed consent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.